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Abstract 



In this thesis we introduce quantum refereed games, which are quantum interactive proof 
systems with two competing provers. We focus on a restriction of this model that we call 
short quantum games and we prove an upper bound and a lower bound on the expressive 
power of these games. 

For the lower bound, we prove that every language having an ordinary quantum inter- 
active proof system also has a short quantum game. An important part of this proof is 
the establishment of a quantum measurement that reliably distinguishes between quantum 
states chosen from disjoint convex sets. 

For the upper bound, we show that certain types of quantum refereed games, includ- 
ing short quantum games, are decidable in deterministic exponential time by supplying a 
separation oracle for use with the ellipsoid method for convex feasibility. 
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List of Abbreviations 



What follows is a list of the complexity classes discussed in this thesis. Each entry in the 
list consists of the name of a complexity class, the page in which the class is first used or 
defined, and an informal definition of that class. 

P, page 131 The class of languages decidable by a deterministic polynomial-time Turing 
machine. 

NP, page 131 The class of languages decidable by a deterministic polynomial-time Turing 
machine with the help of polynomial-size "proof" strings. 

coNP, page 131 The class of languages whose complements are in NP. 

PSPACE, page |31 The class of languages decidable by a deterministic polynomial-space Tur- 
ing machine. A polynomial-space Turing machine visits at most a polynomial number 
of cells on its tape before halting. 

EXP, page 131 The class of languages decidable by a deterministic exponential-time Turing 
machine. 

NEXP, page 131 Same as NP except that the "proof" strings may have exponential size. 

coNEXP, page 131 The class of languages whose complements are in NEXP. 

IP(c, s), page [5l The class of languages that have interactive proof systems with complete- 
ness error c and soundness error s. 

RG(c, s), pageini The class of languages that have refereed games with completeness error 
c and soundness error s. 

RGi (c,s), page ini The class of languages that have one-round refereed games with com- 
pleteness error c and soundness error s. A round consists of a message from the verifier 
to each of the provers in parallel followed by their responses. 

BQP, page IT^ The class of languages decidable by a polynomial-time uniform family of 
quantum circuits. Widely considered to be the quantum analogue of P. 

QIP(c, s), page [TBI The class of languages that have quantum interactive proof systems 
with completeness error c and soundness error s. 
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QRG(c, s), page ITHl The class of languages that have quantum refereed games with com- 
pleteness error c and soundness error s. 

SQG(c, s), page I19L The class of languages that have short quantum games with complete- 
ness error c and soundness error s. A short quantum game is a one-round quantum 
refereed game in which the verifier may process the yes-prover's response before sending 
a message to the no-prover. 

SQG*(c, s), page IT^ Same as SQG(c, s) except that the verifier cannot send a message to 
the yes-prover. 

DQIP(c, s), page ISSl The class of languages that have double quantum interactive proof 
systems with completeness error c and soundness error s. A double quantum interac- 
tive proof system is a quantum refereed game in which the verifier exchanges several 
messages with only the yes-prover and then several messages with only the no-prover. 
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Chapter 1 
Introduction 



In this thesis we define a new model of computation that incorporates existing models based 
upon the notions of competitive interaction and quantum information. We focus on a variant 
of this new model with a restricted protocol for interaction and we prove lower and upper 
bounds on the power of this restricted model. In the process of proving these bounds, we 
develop new computational and information-theoretic tools that may prove useful in other 
fields in computer science and physics. 

This introductory chapter starts with an informal overview of our results in Section 11.11 
We offer a survey of relevant topics from complexity theory in Section 11.21 and a review 
of quantum information in Section 11.31 Chapter |21 formalizes the fundamental concepts 
discussed in this thesis — the interested reader can find a more precise statement of the 
contributions of this thesis in Section 12.2.21 on page EH Chapters El and El are devoted to 
proving the results stated in that section. We conclude with Chapter which mentions 
some open questions and possible directions for future research. 

1.1 Overview 

It is intended that this first section provide the reader with a bird's eye view of the direction 
in which this thesis is headed. For the sake of clarity, citations, technical detail, and an 
adequate history are absent. These gaps will be addressed in subsequent sections and in 
Chapter |21 as we cover the necessary background material in greater detail. On that note, 
we begin. 

Given a new model of computation, an effective way to quantify the expressive power of 
that model is to compare it to other more fundamental models. These comparisons derive 
meaning from the fact that fundamental models of computation often capture important 
notions such as efficient computation in the physical world or the difficulty of solving certain 
computational problems. For example, it is widely believed that any problem that can 
be solved efficiently by a device built based upon Newtonian physics (such as a desktop 
computer) can also be solved by a randomized polynomial-time Turing machine and vice 
versa. 
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An interactive proof system is a more exotic model of computation in which a randomized 
polynomial-time Turing machine (a verifier) is endowed with the ability to interact with an 
entity who is computationally unbounded but not necessarily trustworthy (a prover). Given 
an input string x, the prover uses his unlimited computational power to attempt to convince 
the verifier to accept x, while the verifier tries to determine the validity of the prover 's 
argument. At the end of the interaction, the verifier accepts x if he believes the prover and 
rejects x if he does not. 

A given set L of strings (a language) is said to have an interactive proof system if there 
exists a verifier V satisfying the following standard completeness and soundness conditions: 

Completeness. There exists a prover P that can convince V to accept any string x & L 
with high probability. 

Soundness. No prover can convince V to accept any string x ^ L except with small prob- 
ability. 

A refereed game is another model of computation that generalizes interactive proof sys- 
tems in that the verifier interacts with not just one, but two provers. In this model, the 
provers use their unlimited computational power to compete with each other: one prover 
(the yes-prover) attempts to convince the verifier to accept x, while the other prover (the 
no-prover) attempts to convince the verifier to reject x. At the end of the interaction, the 
verifier decides whether to accept or reject the input x, effectively deciding which of the 
provers wins the game. 

Similar to interactive proof systems, a language L is said to have a refereed game if there 
exists a verifier V satisfying the following slightly modified completeness and soundness 
conditions: 

Completeness. There exists a yes-prover Y that can convince V to accept any string x £ L 
with high probability, regardless of the no-prover. 

Soundness. There exists a no-prover that can convince V to reject any string x ^ L 
with high probability, regardless of the yes-prover. 

At a glance, these two models of computation may seem obscure and uninteresting. 
However, it can be shown that they characterize two very fundamental models of computation 
in the following sense: 

• A language has an interactive proof system if and only if it can be decided by a 
polynomial-space Turing machine. 

• A language has a refereed game if and only if it can be decided by a deterministic 
exponential-time Turing machine. 

These surprising characterizations bring to light a very deep connection between exotic 
interaction-based models and space- and time-bounded Turing machines. 
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Given the recent proliferation of the theory of quantum computation, it is natural to 
consider the possible effects of quantum computers on models such as interactive proof 
systems and refereed games. How does the power of these models change if the verifier and 
provers are permitted to perform quantum computations and exchange quantum messages? 

Perhaps the most striking contrast between the quantum and nonquantum {classical) 
cases is that any quantum interactive proof system can be simulated by another quantum 
interactive proof system in which the verifier and prover exchange only three messages. 
With classical interactive proof systems, all evidence suggests that such a simulation does 
not exist, be it with three or any other fixed number of messages. What is it about quantum 
information that permits this strange shortening of interactions? 

In this thesis, we turn our attention to quantum refereed games, which have not been 
previously studied. We focus on a restricted variant of the quantum refereed game model 
that we call short quantum games and we prove both a lower bound and an upper bound on 
the expressive power of these games. 

For the lower bound, we prove that any language having a quantum interactive proof 
system also has a quantum refereed game with the following protocol: the yes-prover sends a 
quantum state to the verifier, who then processes this state and forwards it to the no-prover. 
The no prover performs a quantum measurement on this state and sends a single classical 
bit of information (either a or a 1) back to the verifier, who finally accepts or rejects based 
upon this bit. In order to prove the correctness of our short quantum game, we establish 
the existence of a quantum measurement that reliably distinguishes between quantum states 
chosen from two disjoint convex sets. 

For the upper bound, we consider a slightly looser restriction of the quantum refereed 
game model in which the verifier exchanges several quantum messages with only the yes- 
prover and then exchanges several more quantum messages with only the no-prover before 
deciding whether to accept or reject. We show that any language having a quantum refer- 
eed game obeying this protocol can be decided by a deterministic exponential-time Turing 
machine. Our proof uses the ellipsoid method, which is a polynomial-time algorithm that 
determines the emptiness of a convex set given implicitly by a separation oracle. 

1.2 Complexity Theory 

In this section we review in greater detail certain concepts from complexity theory that lead 
to the notion of competitive interaction as a model of computation and we survey known 
results pertaining to that model. We assume at the onset that the reader is familiar with 
fundamental notions such as languages, Turing machines, polynomial-time computability, 
completeness, and the following fundamental complexity classes: 

• The polynomial-time classes P, NP, and coNP; 

• The exponential-time classes EXP, NEXP, and coNEXP; and 

• The polynomial-space class PSPACE. 
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Figure 1.1: Relationships among fundamental complexity classes 

Figure 11.11 depicts the known relationships among these complexity classes. In that figure, 
class A contains class B if A can be reached from B by following a path of only upwardly 
sloped edges. 

We now establish some relevant notation that will be used throughout this thesis. We 
let poly denote the set of polynomial-time computable functions / : N ^ N \ {0} for which 
there exists a polynomial p such that f{n) < p{n) for all G N. The sets 2^"^"^^ and poly~ 
are derived from poly as follows. A polynomial-time computable function £ : N — > [0, 1] is in 
2-p°^y if there exists / G poly such that e{n) = 2~f^'^'^ for all n G N. Similarly, e is in poly~^ 
if there exists / G poly such that e{n) = for all n eN. 

All strings are over the binary alphabet {0, 1}. We let {0, 1}*^ denote the set of strings 
of length n and we let {0, 1}* denote the set of all finite strings. For any x G {0, 1}*, \x\ 
denotes the length of x. 

1.2.1 Nondeterminism 

The notion of nondeterminism and the discovery in the 1970's of NP-complete problems 
123 drew unprecedented attention to the field of computational complexity theory. Since 
then, several characterizations of NP have been found ^12^ .4^ .3j and several generalizations of 
nondeterminism have been explored El ^] • One of the simpler characterizations views 
nondeterministic computation as deterministic verification of a short proof. Specifically, a 
language L C {0,1}* is in NP if and only if there exists p G poly and a deterministic 
polynomial-time Turing machine M such that, for all input strings x G {0, 1}*: 

• If x G L then there exists y G {0, Ij^d^D such that M accepts the pair (x, y). 

• \i X ^ L then M rejects the pair (x, ?/) for all y G {0, Ij^d^D. 
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The Turing machine M in this characterization can be viewed as a verifier. The string y 
submitted to M can be viewed as a proof of the claim, "x is in L." Informally, the conditions 
of this characterization tell us that every x G L has a proof y that can be used by the verifier 
to verify this claim in deterministic polynomial-time. Moreover, ii x ^ L then no proof could 
possibly convince the verifier otherwise. 

1.2.2 Interaction 

The notion of interaction was introduced in 1985 by Babai and by Goldwasser, Micali, and 
Rackoff [18j as a generalization of nondeterminism that extends the verifier-proof analogy 
by allowing a two-way dialogue between the verifier and the mysterious supplier-of-proofs. 
Specifically, a prover is an entity with unlimited computational power whose goal is always 
to convince the verifier to accept the input string x. The verifier may ask questions of the 
prover, perform randomized polynomial-time computations, and ask additional questions of 
the prover based upon these computations and upon answers to previous questions. At some 
point the verifier must end the interaction and decide whether or not to accept x. 

Such an interaction is called an interactive proof system. It follows from the fact that 
the verifier is restricted to polynomial-time computation that the amount and size of the 
messages exchanged between the verifier and prover must be polynomial in Because the 
verifier may also invoke randomization, it is plausible that his decision to accept or reject x 
could differ between independent executions of the same interaction. Hence, an allowance is 
made for unlucky coin tosses that cause the verifier to erroneously accept or reject x with 
some small probability. 

In this thesis we pay considerable attention to the error probability associated with 
different forms of interaction. In particular, we are interested in any possible differences 
between the probability of a false negative [completeness) and of a false positive [soundness) . 
We also consider a more general case in which these probabilities might even vary as a 
function of the input length However, in order to prevent the polynomial-time verifier 
from accessing hard-to-compute values encoded in the error probability, we restrict our 
attention to error probabilities that are polynomial-time computable. 

All these ideas are formalized in the following definition. For any polynomial-time com- 
putable functions c, s : N — [0, 1], a language L C {0, 1}* is said to have an interactive proof 
system if there exists a randomized polynomial-time verifier V that satisfies the following 
completeness and soundness conditions for all input strings x G {0, 1}*: 

Completeness. If a; G L then there exists a prover P that convinces V to accept x with 
probability at least 1 — c(|x|). 

Soundness, li x ^ L then no prover can convince V to accept x with probability greater 
than s(|a;|). 

The functions c and s are called the completeness error and soundness error respectively. 
Finally, we let \P[c,s) denote the complexity class of languages that have interactive proof 
systems with completeness error c and soundness error s. 
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1.2.3 Competitive Interaction 

Many different models resembling competitive interaction have been studied in the context 
of game theory since the 1950's, but competitive interaction was not considered as a gen- 
eralization of interactive proof systems until 1990 In this generalization, the verifier 
interacts with not one, but two provers with unlimited computational power. As mentioned 
in Section 11.11 these two provers use their power to compete with each other: one prover, 
called the yes-prover, attempts to convince the verifier to accept the input string x, while 
the other prover, called the no-prover, attempts to convince the verifier to reject x. 

As before, the verifier may perform randomized polynomial-time computations. He may 
also ask questions of each of the provers and base future questions upon randomized compu- 
tations and answers to previous questions. At the end of the interaction, the verifier decides 
whether or not to accept x. Such an interaction is called a refereed game because it can be 
viewed as a game between the two provers in which the verifier acts as a referee by ensuring 
that the provers obey the rules of the game and by announcing a winner at the end. 

More formally, for any polynomial-time computable functions c, s : N — >^ [0, 1], a language 
L C {0, 1}* is said to have a refereed game if there exists a randomized polynomial-time 
verifier V that satisfies the following completeness and soundness conditions for all input 
strings x G {0, 1}*: 

Completeness. If x G L then there exists a yes-prover Y that convinces V to accept x with 
probability at least 1 — c(|x|), regardless of the no-prover's strategy. 

Soundness. If x ^ L then there exists a no-prover that convinces V to reject x with 
probability at least 1 — s(|a;|), regardless of the yes-prover 's strategy. 

As with interactive proof systems, the functions c and s are the completeness error and 
soundness error respectively. Finally, we let RG(c, s) denote the complexity class of languages 
that have refereed games with completeness error c and soundness error s. 

It is also of interest to consider refereed games in which the verifier exchanges just one 
round of messages with the provers. In particular, these one-round refereed games obey 
the following protocol: a message from the verifier to each of the provers, followed by their 
responses to the referee, followed by the referee's decision. We let RGi(c, s) denote the 
complexity class of languages that have one-round refereed games with completeness error c 
and soundness error s. 

1.2 A Reasonable Error 

In Section 11.2.21 we prevented the verifier from accessing hard-to-compute error probabil- 
ities by requiring that they be polynomial-time computable. But even interactions with 
polynomial-time computable error probabilities can still have undesirable properties. 

Suppose, for example, that the probability of correctly accepting or rejecting an input 
X G {0,1}* is exponentially close to | in It is clear that such an interaction can be 
simulated with exponential accuracy by a verifier who ignores all provers and accepts or 
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rejects based solely upon the result of a coin flip. Of course, an interaction with this property 
is not very interesting. 

With this example in mind, we say that polynomial-time computable functions c, s : N — > 
[0, 1] are reasonable if there exists 7 G poly~^ such that 

1 — c{n) — s{n) > 7(n) 

for all n E N. As c and s are polynomial-time computable, the verifier can compute them 
and bias his final decision so that the completeness and soundness error of his biased decision 
are both bounded below ^ by at least an inverse polynomial as desired. 

Many (but not all) results concerning interaction are known to hold only when the func- 
tions c and s are reasonable. We mention the reasonability condition explicitly whenever it 
is required. 

1.2.5 Known Results 

Several inclusions follow immediately from the definitions of \P{c,s) and RG(c, s). For ex- 
ample, because an interactive proof system is just a refereed game without a no-prover, it is 
clear that IP(c, s) C RG(c, s). 

Also, these classes are easily seen to be robust with respect to error in the sense that any 
interaction with reasonable error can be simulated by another interaction with exponentially 
small error. More formally, for every e G 2"*'°'^ and every reasonable c, s : N — [0, 1] we have 

IP(c, s) C \P{e, e) and RG(c, s) C RG(e, e). 

To prove these containments it suffices to note that any interaction can be repeated inde- 
pendently many times in succession. If the verifier for such a repeated interaction bases his 
decision upon a majority vote of the outcomes of each of the repetitions then it follows from 
Chernoff bounds that the error of the repeated interaction decreases exponentially in the 
number of repetitions. 

Of course, sequential repetition necessarily increases the number of rounds in an in- 
teraction and so this simple error reduction technique does not apply to bounded-round 
interactions such as one- round refereed games. Fortunately, as we shall soon see, RGi (c,s) 
can still be shown to be robust with respect to error. 

An even stronger robustness result is known to hold for IP(c, s). In particular, an in- 
teractive proof system with reasonable error can be simulated by another interactive proof 
system with zero completeness error I^TUHj. It follows that 

IP(c,s) C IP(0,£) 

for every e G 2"^°^^ and every reasonable c, s : N ^ [0,1]. By contrast, it is not known 
whether zero error (completeness or soundness) can be achieved for refereed games. In light 
of these robustness results, we define the following shorthand notations: 

• IP is the complexity class of all languages L C {0, 1}* such that L G IP(0,e) for every 
e G 2-P°^y. 
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• RG is the complexity class of all languages L C {0, 1}* such that L G RG(e, e) for every 

• RGi is the complexity class of all languages L C {0, 1}* such that L G RGi(5, 5) for 

every e G 2-P°^y. 

The interactive proof system model has a rich history. However, a comprehensive survey 
of that history is tangential to the scope of this thesis and so we summarize only the results 
most relevant to our purpose. 

Because interaction is a generalization of nondeterminism, it is clear that NP C IP. The 
full extent of the power of interaction was not fully known until 1990 when Lund, Fortnow, 
Karloff, and Nisan developed the arithmetization technique [^3] that was used in Reference 
112] to show 

IP = PSPACE 

(see also Reference jlB])- This surprising characterization of polynomial-space computation 
has prompted further study of models of computation based upon interaction, one example 
of which is refereed games. 

The refereed game model and several variations thereof were studied in References j38( 
IT^ im 1231 among others. Many results concerning refereed games can be gleaned from 
results in game theory. For example, in game theoretic terms, refereed games correspond 
to two-person games of incomplete information because messages exchanged between one 
prover and the verifier are kept secret from the other prover. In 1992, Koller and Megiddo 
P5] gave a deterministic algorithm that solves two-player games of incomplete information 
in time polynomial in the size of an induced structure known as a game tree. The game 
tree induced by a refereed game on input x G {0,1}* is easily shown to have size at most 
exponential in from which it follows that RG C EXP. 

Feige and Kilian used a variant of arithmetization to prove the reverse inclusion, 
implying 

RG = EXP. 

They also proved the inclusions RGi(c, s) C PSPACE and PSPACE C RGi(£:,£:) for every 
e G 2~^°'^ and every reasonable c, s : N — > [0, 1]. These inclusions imply the aforementioned 
robustness of one-round refereed games as well as the characterization 

RGi = PSPACE. 

1.3 Quantum Information and Computation 

In this section we describe the framework of quantum information. Our description is not 
intended to be comprehensive, but merely to refresh the reader with the aspects of quantum 
information that are relevant to this thesis and to establish notation. 

We assume familiarity with fundamental concepts from linear algebra such as complex 
numbers, vectors, vector spaces, matrices, and basic matrix-related concepts such as matrix 
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multiplication and the trace of a matrix. Of course, familiarity with quantum information 
and quantum circuits is an asset. 

1.3.1 Linear Algebra 

For any positive integer M, elements of the vector space are identified with M- 
dimensional column vectors in the usual way and arc denoted by lowercase Roman letters 
such as u,v,w, etc. For any vector v G C^^, the conjugate-transpose of v is denoted f*, 
which is an M-dimensional row vector. For any vectors v/w G C^, the standard inner 
product between v and denoted {v,w), is given by 

(v, w) = v*w. 

The norm induced on by the standard inner product is the Euclidean norm. For v G C^, 
this norm is denoted \\v\\ and given by 

||^;|| = ^/ {v,v). 

The vector space C^^ endowed with the standard inner product is a Hilhert space. More- 
over, every Hilbert space in this thesis is assumed to take this form for some positive integer 
M. Hilbert spaces are denoted by uppercase script letters such as Q, H, etc. 

Wc note at this point that it is a common practice in quantum information to use Dirac 
notation to describe column and row vectors. For example, the vector v E Ti would be 
denoted 1^), the corresponding row vector v* would be denoted (vj, and the inner product 
{v,w) would be denoted {v\w) using this notation. However, Dirac notation is found to be 
cumbersome for our purposes and so we break from convention by restricting its use in the 
following manner: Dirac notation is used in this thesis only to describe the vector IOt^) G ?i, 
which always denotes the first clement in the standard orthonormal basis for Ti. In other 
words, the vector |0-^) always denotes the vector with a 1 in the first entry an all other 
entries equal to zero. We sometimes write |0) when the Hilbert space Ti. is clear from the 
context. 

For any Hilbert spaces J- and Q of dimensions M and N respectively, we let 'L{T,Q) 
denote the set of linear mappings from JF to Q. Elements of L(jF, ^) are identified with 
N X M matrices in the usual way (with respect to the standard bases for and Q) and are 
denoted by uppercase Roman letters such as A,B,C, etc. For any matrix A G ^{T, Q) we 
let A[i,j\ G C denote the [i,j\ entry of A. The spectral norm of A, denoted ||^||, is given by 

II ^11 M^ll 
\\A\\ — sup — — T—. 

As with vectors, the conjugate-transpose of A is denoted A*, which is an element of L((y, T). 
As a natural extension of the standard inner product for vectors, the Hilhert- Schmidt inner 
product between any pair of matrices A^Be L(^, ^), denoted (^4, S), is given by 

{A,B) ^tY{A*B). 
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Two Hilbert spaces ^1,^2 of dimensions Mi,M2 can be combined via the Kronecker 
product to form a larger Hilbert space J-'i ® of dimension M1M2. The Kronecker product 
is also defined on vectors and matrices so that for e JF^, t>2 e ^2 we have 

vi <Si V2 e J^i <Si T2 

and for Ax G L(jFi, ^1), G L(jF2, ^2) we have 

^1 (g) ^ e L(J^i (g) JP-i, ^1 ^2). 

The Kronecker product satisfies many convenient and intuitive properties that we do not list 
here. 

We write L(jF) as a shorthand notation for L(jF, JF) and we say that a matrix A G L(jF) 
acts on T . Wc let /jr G L(jF) denote the identity matrix acting on JF, which we often 
abbreviate to / when the Hilbert space T is clear from the context. Often in this thesis we 
multiply matrices acting on a certain Hilbert space with matrices or vectors from a larger 
Hilbert space. In these cases wc implicitly assume that the smaller matrix is extended to 
the larger Hilbert space by taking the Kronecker product with the identity. For example, if 
A G L(J'), B G L(JF ® Q)^ and v ^ T ®Q then AB and Av always mean {A ® Ig)B and 
{A ® Ig)v respectively. 

The partial trace is a linear mapping 

trg : L{J^®g) L(JP) 
defined for all A G L{J^), B G L(^) as 

iig{A®B) =ti{B)A 

and extending to all of L(jF(g)^) by linearity The partial trace is in some sense complimentary 
to the Kronecker product in that the Kronecker product combines two matrices acting on 
separate Hilbert spaces to form one matrix acting on one larger Hilbert space. In contrast, 
the partial trace takes as input a matrix acting on a larger Hilbert space and produces a 
matrix that acts on a smaller Hilbert space. 

A matrix A G L(jF) is unitary ii A*A = I, Hermitian if A = A*, and positive semidefinite 
if v*Av is a nonnegative real number for every v & J-'. We define the following subsets of 
L(^): 

• The set U(^) C L(^) contains all unitary matrices in L(^). 

• The set H(J^) C L(J^) contains all Hermitian matrices in L(J^). 

• The set Pos(jF) c H(jF) contains all positive semidefinite matrices in L(jF). 

• The set D(^) C Pos(^) contains all positive semidefinite matrices A with tr^A) = 1. 

Elements of D(^) are called density matrices and are typically denoted by lowercase Greek 
letters such as p,^, etc. 
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1.3.2 Qubits 



A qubit is a fundamental unit of quantum information described as follows. Any collection 
of m qubits has a corresponding Hilbert space JF of dimension 2"^. Any density matrix 
p G D(JF) completely describes some state of those m qubits. Furthermore, any physically 
realizable state of those m qubits is uniquely described by some density matrix, so it makes 
sense to refer to any such p as a "state" of those m qubits. 

If p G D(^) is given by p = vv* for some vector f G then p is called a pure state. It 
must be the case that ||t>|| = 1 (that is, f is a unit vector) and p is completely described by 
V, so it makes sense to refer to any unit vector f as a "pure state" of those m qubits. Note 
that the unit vector v ^ T describing a pure state vv* G D(jF) is not unique because the 
vector u = ujv satisfies vv* = uu* for any u; G C with \uj\ = 1. 

Let ^ be a Hilbert space of dimension 2" corresponding to a collection of n qubits. Then 
the Hilbert space corresponding to the combined collection of m + n qubits is J-'^Q and has 
dimension 2'""'"". If p G D(JF (g) ^) is any state of those m + n qubits then trg(p) G D(jF) 
always describes the state of the first m qubits and trjc-(p) G D(^) always describes the state 
of the remaining n qubits. Although it is the case that p = trg(p) ® tr;c-(p) whenever trg(p) 
or trjF(p) is a pure state, this equahty does not hold for every p G D(^ ® Q). 

1.3.3 Quantum Circuits 

The model of quantum computation that provides a foundation for quantum interaction is 
the quantum circuit model. All quantum circuits in this thesis are assumed to be composed 
of a finite number of quantum gates, each of which is chosen from some finite universal set 
of quantum gates. We do not discuss the details of quantum gates or universality, as those 
details are not required to understand the material presented in this thesis. In lieu of such 
a discussion, we refer the interested reader to References [21 El 123 HE] ■ 

For any quantum circuit Q acting on m qubits with corresponding Hilbert space JF, 
there is a unitary matrix U G U(JF) associated with Q. This matrix models the action of 
Q upon its m input qubits in the state p G D(jF) so that the state of those m qubits after 
Q is applied becomes UpU* G D(jF). This formalism extends without complication to any 
positive semidefinite matrix p G Pos(jF). If p = vv* for some pure state f G then the 
resulting state is the pure state Uv G J-' and this formalism extends without complication to 
any nonzero vector v ^ J-". 

Two additional facts concerning quantum circuits warrant attention. First, it is important 
to note that we lose no generality by allowing only unitary quantum circuits because any 
physically realizable quantum process can be simulated by unitary circuits as described in 
Reference |2] . We elaborate on this simulation in Section 13.1.11 

Second, the universality condition placed on our set of admissible quantum gates implies 
the following fact: for any unitary matrix V G U(JF) and any real e > 0, there is a quantum 
circuit with associated unitary matrix U G U(JF) that satisfies 

\\U-V\\ < e. 
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Although the spectral norm of the difference between U and V is not always a convenient 
measure of the "distance" between two matrices, in this case it allows us a simple way to infer 
that any desired unitary matrix V can be approximated as closely as desired by quantum 
circuits considered in this thesis. 



1.3.4 Measurement 

So far, we have discussed qubits and quantum circuits that act on qubits. It is now time 
to discuss measurements, which allow us to extract classical information from qubits and 
enable us to solve real-world problems using quantum information. 

Quantum measurements have several formalizations, each differing in their simplicity and 
generality. Although knowledge of only the most basic notion of measurement is required 
throughout most of this thesis, the results of Chapter |21 make use of the extended gener- 
ality offered by more complex formalizations. Hence, we introduce in this subsection the 
most general form of quantum measurement, since the added complication of this form is 
insignificant anyway. 

Let JF be a Hilbert space corresponding to some collection of qubits and let F be a finite 
set of outcomes. A quantum measurement of those qubits with outcomes in F is defined by 
a set of matrices 



satisfying 

When such a measurement is performed on qubits in some state p G D(jF), the outcome 
of the measurement is r with probability ti{A^pA*^) for each r G F. Conditioned on the 
outcome r, the state of the qubits becomes 



ti{A,pA%] 



GD(^) 



once the measurement is complete. If p = vv* for some pure state v ^ T then the outcome 
of the measurement is r with probability HA^tiH^ and the resulting state is the pure state 

A^v ^ 
G T. 



\ArV\ 



Often, we do not care about the state of the qubits once the measurement is complete. 
Because the probability of outcome r is 

\Arvf = V*AlArV 

for pure states and 

tr (ArpAl) = tiiAlA^p) = {AlAr,p) 
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for general states, it follows that the quantum measurement is completely specified in this 

case by the set 

{E^:tET} C Pos(J^) 
of positive semidefinite matrices defined by Er = A*At- for each r G F and hence satisfying 

Any measurement expressed in this way is called a positive operator-valued measurement 
(POVM) for historical reasons. 

It is often convenient to specify only a POVM with the understanding that we do not care 
about the state of the qubits once the measurement is complete — this is the formalism of 
quantum measurements used in ChapterEl In all other chapters, the quantum measurements 
we discuss have outcomes in F = {accept, reject} and take the following form. For any Hilbert 
space JF corresponding to m qubits, one of those qubits is designated as the output qubit. 
Let T = O ® T' where (9 is a two-dimensional Hilbert space corresponding to the output 
qubit and T' corresponds to the remaining m — 1 qubits. We fix the binary POVM 

{Flaccept, nreject} C Pos(J-') 

SO that 

Flreject = 1 0©) (Oo | (g) /^/ , 
Flaccept Flj-gject- 

This measurement is called the standard measurement of the output qubit of JF. 
1.3.5 Quantum Algorithms 

We now describe how qubits, quantum circuits, and quantum measurements combine to 
form the quantum circuit model of computation. Let p be a quantum state and let Q be 
a quantum circuit with associated unitary matrix U. If desired, the input state p may be 
chosen so that it uniquely encodes an input string x to some computational problem. The 
circuit Q is applied to p and the output qubit of the resulting state UpU* is measured 
according to the standard measurement, which indicates acceptance or rejection of p and 
hence of the input string x. 

By definition, quantum circuits act on a fixed number of qubits. In order to use quantum 
circuits to decide a language L C {0, 1}* of arbitrarily large strings, it is typical to specify a 
family of quantum circuits. In this thesis, a family is a set 

{Q, :xe{0,ir} 

of quantum circuits indexed by input strings. Because the quantum gates in can depend 
upon X, there is no need to encode x in the input state p. Instead, we may fix once and for 
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all a convenient pure state |0) upon which all quantum circuits in the family can be assumed 

to act. 

Families of quantum circuits do not yet form a realistic model of computation because 
we have not restricted the amount of computation that is used to construct the circuits in a 
family. In order to make the model realistic, we must introduce a uniformity constraint. In 
particular, a family of quantum circuits is said to be polynomial-time uniformly generated if 
there exists a deterministic polynomial-time Turing machine that, given input x G {0, 1}*, 
outputs a description of the quantum circuit Qr^. 

For any language L C {0, 1}*, it is widely agreed that the informal statement "L has an 
efficient solution on a quantum computer" is adequately formalized by the condition that 
there exist a polynomial-time uniformly generated family {Q^ : x e {0,1}*} of quantum 
circuits with associated unitary matrices 

{U,:xe{0,ir} 

such that, for every x G {0, 1}*, Qx correctly accepts or rejects |0) according to whether or 
not x e L with high probability. More specifically, 

||nacceptC/x|o)||'>2/3 ^ xeL, 

||nrejectC/x|0)||' > 2/3 ^ X ^ L. 

The class of languages with this property is denoted BQP and is considered to be the quantum 
analogue of the complexity class P. 
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Chapter 2 
Preliminaries 



In this chapter we provide formal definitions of the quantum interactive proof system and 
quantum refereed game models of computation as well as several collections of complexity 
classes based upon these models. We then summarize what is currently known of these 
models and state the contributions of this thesis. 

2.1 Formalizations of Quantum Interaction 

Quantum interactive proof systems were introduced by Watrous in 1999 jlH] and it is that 
formalization of the model that we reproduce here. Although quantum refereed games had 
not yet been considered prior to the work of the present thesis, the formalization of that 
model is a straightforward extension of the quantum interactive proof system model. 

Quantum interactions consist of a verifier and one or more provers. For any function 
r : N — >■ N \ {0}, an r-round prover P is a mapping on input strings x G {0, 1}* where 

P{X) = (Pi,...,P,(|,|)) 

is an r(|a;|)-tuple of quantum circuits, each of which acts upon the same number of qubits. 
No restrictions are placed on the complexity of the prover's circuits, which captures the 
notion that the prover has unlimited computational power — each of the prover's circuits can 
be viewed as an arbitrary unitary operation on its input qubits. 

Similarly, an r-round verifier is a mapping on input strings x G {0, 1}* where 

y(x) = (K),...,v;(|.i)) 

is an + l)-tuple of quantum circuits, each of which acts upon the same number of 

qubits. Unlike a prover, however, we require that the verifier's circuits be generated by a 
polynomial-time Turing machine on input x. This uniformity constraint captures the notion 
that the verifier's computational power is limited and implicitly restricts the quantity r(|a;|) 
so that r G poly as one might expect. We often abbreviate r(|a;|) to r for easier readability. 



15 



V 
M 
V 



Pi 



p. 



output 
qubit 



Figure 2.1: Quantum circuit for a two- round quantum interactive proof 
2.1.1 Quantum Interactive Proof Systems 

A quantum interactive proof system has a verifier V and a prover P. The qubits upon which 
each of the circuits in the prover's r-tuple acts are partitioned into two sets: one set of qubits 
is private to the prover and the other is shared with the verifier. These shared qubits act as 
a quantum channel between the verifier and the prover. The Hilbert spaces corresponding 
to the private and shared qubits of the prover are denoted V and Ai respectively. 

Similarly, the qubits upon which each of the circuits in the verifier's (r + 1)- tuple acts 
are partitioned into two sets: one set of qubits is private to the verifier and the other is 
shared with the prover. The Hilbert spaces corresponding to the private and shared qubits 
of the verifier are denoted V and Ad respectively. 

For any input string x G {0, 1}* we create a composite circuit {V, P){x) by concatenating 
the circuits 

M), -Pi; ^1; • • • ; Vr-1, Pr, Vr 

in sequence, each circuit acting only upon the sets of qubits stipulated previously. Such a 
circuit is illustrated in Figure I^^Tl for the case r = 2. The Hilbert space upon which (V, P){x) 
acts is denoted 

S = V ® M®V. 

The quantum interactive proof system is implemented by applying the circuit (y, P)(x) to 
the initial pure state IO5) G S. Hence, the pure state of the system after (V, P){x) is applied 
is precisely 

y,P,K-i ■ ■ ■ ViPiVo\Qs) e s. 

Acceptance is dictated by a standard measurement of the output qubit of S, which is assumed 
to belong to the verifier. In particular, (V,P)(x) accepts x with probability 

II nacceptKPrK-l ■ ■ ■ V,P,Vo\Os) f 

and rejects x with probability 

\\U,,^ectVrPrVr-l---V,PiVo\Os)f 

where Haccept, Hreject ^ Pos(5) are as defined in Section 11.3.41 

We now define a collection of complexity classes based upon quantum interactive proof 
systems. For any polynomial-time computable functions c, s : N — ^ [0, 1], the class QIP(c, s) 
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consists of all languages L C {0, 1}* for which there exists an r-round verifier V that satisfies 
the following completeness and soundness conditions: 

Completeness. There exists an r-round prover P such that, for all x G L, (V,P)(x) re- 
jects X with probability at most c(|x|). In other words, there exist unitary matrices 
Pi, . . . , G U(P ® M) such that 

||n,ejectKPr-K-l " " " ViPiVo\%) f < c{\x\) . 

Soundness. For all r-round provers P and all x ^ (V, P)(x) accepts x with probability 
at most In other words, for all unitary matrices Pi, . . . , P^ G U(P ® A^), we 

have 

\\Ii.cceptVrPrVr-l- ■ ■ViPiVo\Qs)\? < s{\x\). 

As with classical interactive proof systems, the functions c and s are called the completeness 
error and soundness error respectively. We often abbreviate c{\x\) to c and s(|a;|) to s for 
easier readability. 

2.1.2 Quantum Refereed Games 

A quantum refereed game has a verifier V and two provers Y and A^. As with quantum 
interactive proof systems, the qubits upon which each of the circuits in the provers' r-tuples 
acts are partitioned into two sets: one set of qubits is private to that prover and the other is 
shared with the verifier. These shared qubits act as a quantum channel between the verifier 
and that prover. 

For clarity, Y is called a yes-prover and A^ is called a no-prover. This distinction is purely 
a notational convenience: the Hilbert spaces corresponding to the private and shared qubits 
of a yes-prover are denoted y and Aiy respectively, whereas the Hilbert spaces corresponding 
to the private and shared qubits of a no-prover are denoted M and Ai n respectively. 

In a quantum refereed game, the qubits upon which each of the circuits in the verifier's 
(r + l)-tuple acts are partitioned into three sets: one set of qubits, with corresponding 
Hilbert space V, is private to the verifier and the two remaining sets have corresponding 
Hilbert spaces Aiy and Ai n and are shared with the yes- and no-provers respectively. 

For any input string x G {0,1}* we create a composite circuit (y,Y, N){x) by concate- 
nating the circuits 

Vo,N,,Y,,Vu...,Vr-l,Nr,Yr,Vr 

in sequence, each circuit acting only upon the sets of qubits stipulated previously. Such 
a circuit is illustrated in Figure 12.21 for the case r = 2. The Hilbert space upon which 
{V, Y, N){x) acts is denoted 

S = y(g) My O V O A<iv O a/". 

Although S also denotes the Hilbert space for quantum interactive proof systems, any ambi- 
guity is always resolved by context. The quantum refereed game is implemented by applying 
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Figure 2.2: Quantum circuit for a two-round quantum refereed game 

the circuit (V, F, N){x) to the initial pure state IO5) e S. Hence, the pure state of the system 
after {V, Y, N) {x) is apphed is precisely 

VrYrNrVr^, ■ ■ ■ ViYiN,Vo\Os) G S. 

As with quantum interactive proof systems, acceptance is dictated by a standard measure- 
ment of the output qubit of S, which is assumed to belong to the verifier. In particular, 
(V^, Y, N){x) accepts x with probability 

• • • ViY,N^Vo\Os) II' 

and rejects x with probability 

||nrejectv;i;iv,v;-i ■ ■ ■ v,y,n^Vo\Os) f . 

We now define a collection of complexity classes based upon quantum refereed games. 
For any polynomial-time computable functions c, s : N — > [0, 1], the class QRG(c, s) consists 
of all languages L C {0, 1}* for which there exists an r- round verifier V that satisfies the 
following completeness and soundness conditions: 

Completeness. There exists an r-round yes-prover Y such that, for all r-round no-provers 
N and all x E L, (V, Y, N){x) rejects x with probability at most c(|x|). In other words, 
there exist unitary matrices Yi, . . . , £ U(3^ (g) My) such that 

\\U,eiectVrYrNrVr-i- ■ - V^Y.N.VMf < c{\x\) 

for all unitary matrices Ni, . . . ,Nr G \J{Mn ® A/"). 

Soundness. There exists an r-round no-prover N such that, for all r-round yes-provcrs Y 
and all x ^ L, {V,Y, N){x) accepts x with probability at most >s(|a;|). In other words, 
there exist unitary matrices A^i, . . . , A^ G 'U{M.n ® jV) such that 

m.cceptVrYrNrVr.l ■ ■ ■ V,Y,N,Vo\Os) f < s{\x\) 

for all unitary matrices Yi, . . . , G 
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Figure 2.3: Quantum circuit for a short quantum game 



As with quantum interactive proof systems, the functions c and s are the completeness error 
and soundness error respectively. 



2.1.3 Short Quantum Games 

For most of this thesis we restrict our attention to a specific class of quantum refereed games 
that we call short quantum games. A short quantum game has a two-round verifier V , a 
one-round yes-prover Y , and a one-round no-prover A^. In these games, the composite circuit 
(y,Y,Ny[x) is created by concatenating the circuits 

Vo,Y^,Vi,N^,V2 

in sequence. In other words, short quantum games are one-round quantum games in which 
the verifier is permitted to process the yes-prover's response before sending a message to the 
no-prover. Figure 12.31 illustrates the quantum circuit for a short quantum game. 

For polynomial-time computable c, s : N — >• [0, 1], we define the collection SQG(c, s) of 
complexity classes by restricting the definition of QRG(c, s) to short quantum games. We 
also define the collection SQG*(c, s) of complexity classes by further restricting the definition 
of SQG(c, s) to short quantum games in which the verifier cannot send a message to the yes- 
prover (in other words, the verifier's first circuit is empty, so that Vq = /). 



2.2 Remarks and Contributions 

This section contains a summary of what is currently known of quantum interactive proof 
systems and quantum refereed games. The contributions of this thesis are stated in Section 
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2.2.1 Known Results 

Several inclusions follow immediately from the definitions in Section I2.1I For example, 
because a quantum interactive proof system is just a quantum refereed game without a 
no-prover, it is clear that 

QIP(c, s) C QRG(c, s). 

Furthermore, we have 

SQG,(c,s) C SQG(c,s) C QRG(c,s), 

as any shorter quantum refereed game can be simulated by a longer quantum refereed game. 

Also, it is clear that any classical interaction can be simulated by a quantum interaction in 
which the verifier simply measures every message he receives from any prover (thus collapsing 
each message to a completely classical state) and otherwise behaves in a classical manner. In 
other words, we have IP(c, s) C QIP(c, s), RG(c, s) C QRG(c, s), and RGi(c, s) C SQG(c, s). 
It is instructive to note that the relation RGi(c, s) C SQG*(c, s) is not immediately seen 
to hold, as SQG^,(c, s) does not permit games in which the verifier sends a message to the 
yes-prover. 

The method of sequential repetition used in Section ll.2.5l to demonstrate the robustness 
of classical interaction can be applied without complication in the quantum setting. That 
is, for every e E 2~^°'^ and every reasonable c, s : N — > [0, 1] we have 

QIP(c, s) C QIP(e, e) and QRG(c, s) C QRG(e, e). 

Similar to the classical case, quantum interactive proof systems with reasonable error can 
be assumed to have zero completeness error jSI], yielding the inclusion 

QIP(c,s)CQIP(0,£). 

In light of this robustness, we define the following shorthand notations: 

• QIP is the complexity class of all languages L C {0,1}* such that L G QIP(0,£:) for 

every e E 2-P°'y. 

• QRG is the complexity class of all languages L C {0, 1}* such that L E QRG{e,e) for 

every e E 2~P°^y. 

• SQG is the complexity class of all languages L C {0, 1}* such that L E SQG(5,£:) for 
every e E 2-P°^y. 

• SQG^, is the complexity class of all languages L C {0, 1}* such that L E SQG*(e,e) for 
every e E 2~P°^y. 

The well-known characterization IP = PSPACE mentioned in Section [1.2.51 implies 

PSPACE C QIP. 
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Watrous gave a three-message quantum interactive proof system demonstrating this contain- 
ment jini- The existence of a three-message quantum interactive proof system for PSPACE 
contrasts with the classical case, wherein it is widely believed that the verifier and prover 
must exchange a nonconstant number of messages in order to decide PSPACE (see Section 

Em. 

This result was later extended to show that any quantum interactive proof system can be 
simulated by a three-message quantum interactive proof system and that these simulations 
are robust with respect to error |31j. This extension gives rise to a natural complete promise 
problem for QIP known as CLOSE-IMAGES, which can in turn be reduced to an exponential- 
size instance of the semidefinite programming problem |3T]. As semidefinite programs can 
be solved in deterministic polynomial time, it follows from the Q IP-completeness of close- 
images that 

QIP C EXP. 

In a later talk on quantum coin-flipping, Kitaev gave a semidefinite program that directly 
simulates many- message quantum interactive proof systems [28j, thus yielding a more direct 
proof of the containment of QIP in EXP. 

Although quantum refereed games were not considered prior to this work, it is nonetheless 
appropriate to mention several facts in this subsection. First, it is clear that the characteri- 
zations RG = EXP and RGi = PSPACE imply 

EXP C QRG and PSPACE C SQG. 

Also, Kitaev's variant [2H1 of the semidefinite program found in Reference jSTj is easily 
extended to yield QRG C NEXP [221 ■ Due to the symmetric nature of quantum refereed 
games, it is clear that QRG is closed under complement, from which it follows that QRG is 
also contained in coNEXP. In other words, we have 

QRG C NEXPncoNEXP. 

In Section l5.1.4l we we discuss possible implications of the curious fact that QRG contains EXP 
and is in turn contained in NEXP flcoNEXP. Chapter Elalso offers a diagram of relationships 
among the complexity classes considered in this thesis. 

2.2.2 Contributions of this Thesis 

We prove in this thesis the following two relationships among the complexity classes defined 
in Section im 

• QIP C SQG, (Chapter ED 

• SQG C EXP (Chapter il) 

The first result is proven in Reference while the second is proven in Reference [22] ■ It 
is those proofs that we reproduce in Chapters 01 and El 

Two of the intermediate results that are proven in order to obtain the containment 
QIP C SQG,, might be of independent interest and so we also list them here: 
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• For any two disjoint closed convex sets Aq, Ai C D(?i) of quantum states, there exists a 
binary POVM such that, for any state p e AqUAi, the POVM will correctly determine 
whether p & Aq or p ^ Ai with probability proportional to the minimal trace distance 
between and Ai. 

• SQG(c, s) C SQG(A;c, s'') fl SQG(c'',fcs) for any c, s : N ^ [0,1] and any k G poly. A 
similar containment holds with SQG^ in place of SQG. 

The first of these intermediate results is a generalization of the well-known fact that two 
quantum states can be distinguished with probability proportional to their trace distance. 
It can also be viewed as a quantitative version of the well-known separation theorems in 
convex analysis. 

The second result indicates a partial robustness of short quantum games with respect 
to error. In particular, it states that the completeness (soundness) error can be made ex- 
ponentially small at the possible cost of soundness (completeness). Error reduction results 
seem to be more elusive in quantum interaction than in classical interaction and this result 
represents a first step toward that end for short quantum games. 

The containment SQG C EXP builds upon the semidefinite program for QIP PH 1^ . 
Hence, we offer a rigorous analysis of that semidefinite program in this thesis as a precursor 
to our result. This precursor leads to several extensions of the containment QIP C EXP. 
For example, we show that semidefinite programming can be used to simulate a quantum 
interactive proof system in deterministic exponential time even if the verifier's circuits are 
generated uniformly in exponential time, so long as they still act on only a polynomial number 
of qubits. In particular, the verifier can exchange an exponential number of messages with 
the prover and can use an exponential number of gates in his quantum circuits without 
raising the power of the model beyond EXP. 

The containment QRG C NEXP is obtained by nondeterministically guessing a yes-prover 
and solving the induced quantum interactive proof system using the aforementioned semidef- 
inite program [22] • Most of the extensions of that semidefinite program also apply to this 
containment concerning quantum refereed games. The only exception is that we still require 
that the verifier exchange only a polynomial number of rounds of messages with the provers. 
This strange restriction is brought on by the fact that a polynomial bound on the number 
of qubits required by the provers in a quantum refereed game is known to hold only if a 
polynomial number of messages are exchanged (see Section [4. 2. 3|) . 

We prove SQG C EXP by a repeated use of semidefinite programming in concert with the 
ellipsoid method for convex feasibility. Once again, many of the aforementioned extensions 
also apply to this containment. For example, our method can simulate a short quantum game 
in deterministic exponential time even if the verifier is permitted to exchange an exponential 
number of messages with the yes-prover, followed by an exponential number of messages 
with the no-prover. 
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Chapter 3 

A Lower Bound for Short Quantum 
Games 

In this chapter we prove that QIP C SQG*, which is the main result of Reference |231- In order 
to prove this containment we exhibit a short quantum game that solves the QlP-complete 
problem CLOSE-IMAGES with completeness error | and exponentially small soundness error. 
To show the correctness of our game, we prove an information-theoretic assertion that there 
exists a quantum measurement that reliably distinguishes between quantum states chosen 
from two disjoint convex sets. We then prove a general error reduction technique for short 
quantum games that allows us to produce a game for close-images in which both the 
completeness error and soundness error are exponentially small. 

We start by defining the close-images problem in Section l3?n We prove the quantum 
measurement result in Section IT^ and use that result in Section to yield a short quantum 
game for close-images. We finish the chapter with our error reduction result in Section 

EH 

3.1 The Close-Images Problem 

Before we can define close-images, we must expand our repertoire of quantum formalism. 
In particular, we discuss the simulation of any physically realizable quantum process by 
means of a unitary quantum circuit in Section 13.1.11 In Section 13.1.21 we consider several 
different distance measures for quantum states and we settle on the trace norm as the distance 
measure of choice for this thesis. A formal statement of the close-images problem appears 
in Section 13.1.31 along with some comments concerning that problem. 

3.1.1 Mixed- State Quantum Circuits 

In Section 11.3.31 we described a standard model of quantum circuits in which every m- 
qubit input state is unitarily mapped to an m-qubit output state. We also mentioned in 
that section that any physically realizable quantum process can be simulated by a unitary 
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Figure 3.1: Simulation of the physical process $ via a quantum circuit Q. 
quantum circuit. 

In particular, suppose T and Q are Hilbert spaces corresponding to the m input qubits 
and n output qubits of some physical process 

$ : D(^) ^ Ti{g). 

Then there exists a unitary matrix U G U(JF ®Q® Q') satisfying 

<l>(p) = tr^^g, {U (/O® |0e^g/)(0e^g,|)f/*) 

for every p G D(jF) where Q' is a new Hilbert space with dim(^') = dim(^). In consideration 
with the discussion in Section ll.3.3| it follows that the matrix U can be approximated as 
closely as desired by a quantum circuit Q acting on m + 2n qubits. In this construction, the 
vector lOg^g/) describes the initial pure state of the remaining 2n input qubits of Q. 

Figure 13.11 illustrates such a circuit. This circuit is sometimes called the Stinespring 
Dilation of $ — its existence is typically attributed to Choi [10] and a proof may be found 
in Kitaev, Shen, and Vyali [29 . The quantum circuits described in this subsection are called 
mixed-state quantum circuits in order to differentiate them from the unitary quantum circuits 
of Section 11.3.31 

Because quantum circuits are composed of a finite number of gates chosen from a finite 
set of universal gates, it is clear that mixed-state quantum circuits, like unitary circuits, can 
be encoded into a finite binary string x G {0, 1}*. It therefore makes sense, for example, to 
define languages over {0, 1}* in terms of mixed-state quantum circuits. 

3.1.2 Distance Measures for Quantum States 

Given two quantum states p, ^ G D(jF), how "close" are they to each other? In particular, 
with what reliability can these two states be distinguished by a measurement? A natural 
way to address the first of these questions is in the context of some norm defined on L(jF). 
It turns out, as we shall soon see, that the second question can be answered if we consider 
the right norm. 

It is standard to define the distance between two matrices p and ^ as the norm of the 
difference p — C,- But different norms induce different distance measures, some of which 
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are more physically meaningful than others. For example, we used the spectral norm in 
Section ll.3.3l to formalize the notion that any unitary matrix can be approximated arbitrarily 
closely by a quantum circuit. Although the spectral norm was sufficient for that purpose, 
the quantity ||p — Cll is not known to have much physical meaning. Hence, all that can be 
said for certain is that if — ^|| is small then p and ^ must be "close" and that the two are 
equal if this quantity is zero. 

A norm that is much more useful for quantifying the distinguishability of quantum states 
is the trace norm, defined for all A G L(jF) as 

II A 11,^ = tr {yj^ . 

To make sense of this definition, we point out that A* A is positive semidefinite for every 
A G L(J^) and that, for every P G Pos(jF), there is a unique Q G Pos(jF) satisfying = P. 
This matrix Q is called the square root of P and is denoted Q = \fP. Thus, the trace norm 
of an arbitrary matrix A G L(jF) is the trace of the unique positive semidefinite matrix 
\/A*A. If A G H(jF) is Hermitian then ||v4||tr is just the sum of the absolute values of the 
eigenvalues of A. In comparison, the spectral norm ||y4|| of a Hermitian matrix A is the 
maximum of the absolute values of the eigenvalues of A. The trace norm and the spectral 
norm are dual to each other with respect to the Hilbert-Schmidt inner product, meaning 
that the following fact holds (see Bhatia jH]): 

Fact 3.1 (Duality of the Spectral and Trace Norms). For every A G L(.^) we have 

\\A\\ =max{|(5,A)| : B G L(J^), \\B\\^^ < 1}, 
||A||^^ =max{|(5,A)| : B G L(J^), ||5|| < 1}. 

For every po,Pi ^ D(jF), the quantity ||po — Pilltr lies in the interval [0,2]. The trace 
norm characterizes the distinguishability of po and pi in the following sense: there exists 
a binary-valued POVM such that if p G {po,Pi} is chosen uniformly at random then the 
POVM correctly determines which of po or pi was chosen with probability 

1 1 „ 

2 + 4IIPO- Pilltr • 

Furthermore, such a POVM is optimal in the sense that no other quantum measurement 
could possibly distinguish between po and pi with a higher rate of success. It is because 
of this property that the trace norm is often a very convenient and satisfactory distance 
measure for quantum states. The quantity ||po ~Pi||tr is sometimes called the trace distance 
between po and pi. 

Incidentally, even if p were chosen from {po, pi} according to some arbitrary and unknown 
distribution, it can still be shown that the same POVM will correctly distinguish between 
Po and pi with probability at least | ||po ~ Pi lltr- 

Besides the trace norm, several other distance measures exist for quantum states. One 
example of such a measure is the fidelity, which is a function 

F : Pos(J^) X Pos(J^) R 
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defined by the expression 



F{X,Y) 



VxVy 



tr 



for every X, F G Pos(jF). If p and ^ are density matrices then F{p,^) always lies in the 
interval [0, 1]. Furthermore, F(p, ^) = 1 if and only if p = ^ and F{p,C,) = if and only if 
p and C, describe perfectly distinguishable quantum states. The fidelity and the trace norm 
are related by the following inequalities, which hold for every p,C, & D(JF) (see Fuchs and 
van de Graaf [T7]): 



Although the fidelity satisfies many useful properties, we need not consider it any further 
because most expressions involving the fidelity can be converted into expressions involving 
the trace norm via ()3.1|) and because the trace norm adequately meets our needs in this 
thesis. 

3.1.3 Statement of the Problem 

For any mixed-state quantum circuit Q : D(JF) D(^), the image of Q is the set 



Given mixed-state quantum circuits Qo and Qi, the definition of close-images promises 
that the images of Qo and Qi either intersect or are disjoint. 

More formally, the CLOSE-IMAGES problem — parameterized by any desired function e G 
— ig defined as in Figure 0121 This problem was implicitly shown to be Q IP-complete in 
Reference jSI] . The statement presented in Figure 13.21 is based upon the formulation found 
in Reference jlU] • In that paper, condition 2 in the promise is stated using the fidelity instead 
of the trace norm. However, it is more convenient for our purposes to rephrase the problem 
in terms of the trace norm. That this rephrased version is equivalent to the original follows 
from (jSH). 



In Section 13.1.21 we pointed out that the trace norm is a distance measure for quantum 
states that characterizes the distinguishability of two states po, pi G D(jF). In this section 
we generalize that notion from single states po, Pi G D(jF) to sets of states Ao,Ai C D(JF). 
We motivate discussion of this generalization in Section 13 .2 . II before we state and prove our 
result in Section 13.2.21 




(3.1) 



{Q(p) : p G D(^)} C D(^). 



3.2 Distinguishing Convex Sets of States 
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Problem. CLOSE-lMAGEs(e). 

Input. Two mixed-state quantum circuits Qo, Qi : D(jF) D(^) acting on m-qubit states. 
Promise. Exactly one of the following conditions holds: 

1. There exist m-qubit states po^Pi ^ D(jF) such that 

<3o(Po) = <5i(Pi)- 

2. For all m-qubit states po,Pi G D(JF), Qo(po) and Qi(pi) satisfy 

ll<5o(po) - Qi(pi)|ltr > 2 -£(m). 
Output. "Accept" if condition 1 holds, "reject" if condition 2 holds. 



Figure 3.2: Definition of CLOSE-IMAGES 
3.2.1 Motivation and Preamble 

Let V be any vector space over R or C (for example, a Hilbert space and the set L(jF) 
are vector spaces over C). A set C C ^ is convex if for every x,y E C and A G [0, 1] we 
have Ax + (1 — X)y G C. It follows from the fact that density matrices have unit trace that 
T){J-') is a convex subset of L(jF). Because mixed-state quantum circuits act linearly on their 
input qubits, it follows that the image of any mixed-state quantum circuit is convex. Hence, 
many results pertaining to convexity can be applied to the images of mixed-state quantum 
circuits. 

In particular, the separation theorems of convex analysis tell us that between any two 
disjoint convex sets there exists a hyperplane that separates them. Typically, the separation 
results are stated in terms of the vector space M". At first, the restriction to real numbers 
might seem like a problem. But fortunately, the set H(jF) of complex Hermitian matrices 

2 

acting on a Hilbert space of dimension n is readily shown to be isomorphic to M" and 
can therefore be regarded as a vector space over M. Because density matrices are always 
positive semidefinite and hence Hermitian, it follows that the separation results apply without 
complication to convex sets of density matrices such as the image of a quantum circuit. 
The separation result of most use to us, recast in terms of H(jF), is stated as follows (see 
Rockafellar W- 

Fact 3.2 (Separation Theorem). Let A,Bc H(JF) be disjoint convex sets with A com- 
pact and B open. There exists H G H(JF) and a G M such that {H,X) > a > {H,Y) for 
every X E A and Y E B. 

By choosing suitable convex sets upon which to apply the Separation Theorem (Fact 
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I3.2|) . we can use the the corresponding hyperplane to define a quantum measurement that 
distinguishes between disjoint images of two mixed-state quantum circuits. As one might 
expect, such a measurement is useful for solving problems such as close-images, in which 
disjoint images must be distinguished from overlapping images. 

3.2.2 A Generalized Distinguishability Result 

Our goal in this subsection is to solve the following generalization of the distinguishability 
problem. We are given p G D(jF) chosen according to some arbitrary and unknown distribu- 
tion from the set {po? Pi}- All we know about po and pi is that po G and pi G Ai where 
Aq^Ai C D(JF) are convex sets of density matrices. Our task is to determine which of po or 
Pi was chosen. With what probability can we correctly make this distinction? 

The answer to this question depends on the minimal trace distance between Aq and Ai 
in much the same way as the distinguishability of po,Pi G D(jF) depends upon the trace 
distance between po and pi. Our formalization of this answer begins with the following 
theorem. 

Theorem 3.3 (Distinguishability of Sets of States). Let Aq.Ai C D(JF) be closed 
convex sets of density matrices and let d denote the minimum of ||po — pi ||tr over all po G 
and all pi G ^i. There exists a binary- valued POVM such that, for every pair po G and 
Pi G Ai, if p is chosen uniformly at random from {po,pi} then the POVM will correctly 
determine which of po or pi was chosen with probability at least | + |- 

Proof. We preface this proof with some comments regarding the quantum measurement that 
we are to construct. The POVM that we apply to p will have outcomes in F = {0, 1} where 
outcome G F indicates that po was chosen and outcome 1 G F indicates that pi was chosen. 
In accordance with Section ll.H.4| the POVM with outcomes in F will be given by the set 
{Eq, El} C. Pos(^) of positive semidefinite matrices satisfying Eq + Ei = I jr. 

Let C denote the event that our POVM yields the correct outcome. That is, the event C 
is said to occur if p = po and we obtain outcome G F or if p = pi and we obtain outcome 
1 G F. According to Section 11.3.41 we have 

Pr[C|p = po] = (^o,Po), 
Pr[C|p = pi] = (Ei,pi). 

As p is chosen uniformly at random, we can combine the previous two conditional probabil- 
ities to obtain 

Ft[C] = ^{Eo,Po) + 1{Ei,pi). 
By similar reasoning it follows that 

PrhC] = i(Ei,po) + ^(i?o,Pi) 

and hence 

Pr[C] - PrhC] = ^{Eo-Ei,po- pi) . 
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This expression will be of use later in this proof. 

We are now ready to begin the proof in earnest. If the minimum d = then it suffices 
that our POVM be as good as a random coin flip. By choosing Eq = Ei = we obtain 

Pr[q = itr(po) + ^tr(pi) = i 

which holds for every po,pi € D(JF) as desired. Hence, for the remainder of this proof we 
assume that d > 0. 
We define 

A = Aq- Ai = {po - pi ■■ po & Ao, pi e Ai} . 

The set A C H(jF) is a closed convex set of Hermitian matrices such that ||X||tr > d for 
every X E A. Let 

B = {YeUiJ^):\\Yl^<d} 

denote the open ball of radius d with respect to the trace norm. The sets A and B satisfy 
the conditions of the Separation Theorem (Fact 12121) , therefore there exists a hyperplane 
that separates them. That is, there exists a Hermitian matrix H G H(jF) and a real number 
a G M such that 

{H, X)>a> {H, Y) 

for every X ^ A and Y ^ B. Note that because the ball B is centred at the origin, we have 
y G i3 if and only if —Y G B and hence a > {H, Y) and a > {H, —Y) , from which it follows 
that a > {H, Y) > —a and in particular a > 0. 

We now use the Hermitian matrix H and the positive reals a and d to construct our 
POVM {Eo,Ei}. Let K = ^H. Then {K,X) > d for every X G ^ and {K, ^Y) < 1 for 
every Y E B. As ranges over all Hermitian matrices with trace norm smaller than 1, it 
follows from the Duality of the Spectral and Trace Norms fFact IXTj) that \\K\\ < 1. 

Now let K^, K_ G Pos(jF) be the Jordan decomposition of meaning that K = 
— and and act on orthogonal subspaces of T. It follows that 

\\K+ + K^\\ = \\K+-K^\\ = \\K\\ < 1 

and hence I — Kj^ — is positive semidefinite. 

The matrices Eq and Ei composing our binary-valued POVM are given by 

Eo = K+ + ^iI-K+-K.), 
Ei = K_ + ^iI-K+- K_) . 

Of course, Eq and Ei are positive semidefinite and satisfy 

Eo + Ei = /, 
Eo - El = K. 
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We now compute the probability with which the POVM yields the correct outcome. 

Pr[C]-PrhC] = l(ir,po-Pi)>^ 

with the inequality following from the fact that K = and po — pi G A for every po ^ -^o 
and pi E Ai. From here, it is straightforward to solve the system 

Pr[C]-PrhC]>^ 
Pt[C]+Pt[-^C] = 1 

and obtain Pr[C] > | + f as desired. □ 

We now use the Distinguishability of Sets of States fTheorem l3.3|) to obtain a result that 
holds even when p is chosen nonuniformly from {po, Pi}- 

Corollary 3.4. Let Aq, Ai, and d be defined as in the statement of Theorem l3.3l The binary- 
valued POVM {Eq,Ei} from the proof of Theorem 13.31 satisfies the following property. For 
every pair po G and pi G .Ai, if p is chosen from {po, Pi} according to some arbitrary and 
unknown distribution then {Eq,Ei} will correctly determine which of po or pi was chosen 
with probability at least |. 

Proof. As in the proof of Theorem 13. 31 let C denote the event that {Eq,Ei} yields the correct 
outcome. We start by pointing out that any binary probability distribution over {po, pi} can 
be expressed as a composition of the uniform distribution and a zero-entropy distribution. 
It will then suffice to show that Pr[C] > | under these two distributions. 

Assume for now that po is the more likely choice — the case in which pi is the more likely 
choice will follow by symmetry. In other words, we assume p is chosen from {po, pi} so that 
p = Po with probability A for some A G [|, 1]. 

Consider the following composite distribution. With probability 2 — 2A we choose p 
uniformly at random from {po,Pi} and with probability 2A — 1 we choose p = Po with 
certainty. It follows that, under this composite distribution, po is chosen with probability A 
as desired. 

Under the uniform distribution (A = |), Theorem 13.31 tells us that 

^ 1 d d 

Pi C] >- + ->-. 

^ ^ - 2 4-2 

Hence, it suffices to show that Pr[C] > | under the zero-entropy distribution (A = 1). We 
achieve this bound using the following facts from the proof of Theorem 13.31 

Pr[C|p = po] = (^o,Po), 

PrhC|p = po] = {Ei,po), 

{Eq - El, Po - pi) > d, 

1 1 Eq — El II ^ 1 . 



30 



Since p = Po with certainty, it follows from the first two expressions that 



Pt[C]-Pt[^C] = {Eo-E,,po). 

The third expression implies that 

(Eo-Eupo) >d+{Eo-Eupi). 

It follows from the fourth expression and from the Duality of the Spectral and Trace Norms 
(Fact EH) that 

\{Eo-E^,p^)\<\\p,l^ = l 
and hence {Eq — Ei,pi) > —1. Combining all these inequalities, we obtain 

Pr[C] -Pr^C] >d-l 

from which it follows that Pr[C] > | as desired. □ 

The most important lesson to take away from the Distinguishability of Sets of States 
(Theorem I3.3|l and Corollary 13.41 is that the POVM {Eo,Ei} depends only upon and 
Ai and not on any particular pair of density matrices in those sets. In other words, the 
very same quantum measurement can be used to distinguish between every pair of density 
matrices chosen from those sets. This independence is critical to the correctness of our 

solution to CLOSE-IMAGES. 

3.3 A Short Quantum Game for Close-Images 

In this section, we prove that any language with a quantum interactive proof system also has 
a short quantum game by solving the QlP-complete problem close-images from Section 
13.1.31 In order to prove membership in SQG*(c, s), we must exhibit a verifier for a short 
quantum game who satisfies the completeness and soundness conditions stated in Section 
12.11 Such a verifier receives one message from the yes-prover and then exchanges a round of 
messages with the no-prover before deciding whether to accept the input. 

Informally, the verifier we seek obeys the following protocol: given descriptions of two 
mixed-state quantum circuits Qq and Qi, the verifier receives states po and pi from the 
yes-prover, randomly chooses i G {0, 1}, applies Qi to pi, and forwards the result to the 
no-prover. The no-prover is then challenged to identify which of Qo(po) and Qi(pi) was sent 
to him. If he succeeds then the verifier assumes that the no-prover can reliably distinguish 
between Qo(Po) and Qi(pi) and hence the images of Qq and Qi are far apart. If he fails 
then the verifier assumes that the no-prover cannot reliably distinguish between Qo{po) and 
Qi{pi) because they are equal and hence the images of Qq and Qi intersect. This argument 
is formalized in the following theorem. 

Theorem 3.5. QIP C SQG,(i,£) for every e e 2-P"^y. 
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1. Receive m-qubit registers Xq and Xi from the yes-prover. 

2. Choose i G {0, 1} uniformly at random and apply Qi to register Xj. Let the output be 
contained in a register Y, which is then sent to the no-prover. 

3. Receive a classical bit b from the no-prover. Accept if b ^ i and reject if b = i. 



Figure 3.3: Verifier's protocol for Theorem 13.51 
Proof. Given any e G 2'^°''^, it suffices to show that close-images (e) is in SQG^,(i,£:). Let 

be any given mixed-state quantum circuits acting on m qubits and let Ai denote the image 
of Qi for i G {0, 1}. The sets Ao,Ai C D(^) are closed convex sets of density operators. 

Consider the verifier for a short quantum game described in Figure 13.31 If (Qo, Qi) is 
a "yes" instance of close-images(£:) then there exist po, pi G D(JF) such that Qo(po) = 
Qi{pi). The strategy for the yes-prover is to prepare the registers Xq and Xi in the states 
Po and pi respectively and to send them to the verifier in step 1 of the verifier's protocol. 
Because Qo(Po) = Qi{pi), the state contained in the register Y is independent of i, so the 
no-prover can do no better than a random guess in step 3. The verifier will therefore accept 
with probability at most | in this case. 

Let d be the minimum of ||po ~ Pi lltr ^^^^ choices of po G and pi G Ai. If {Qo, Qi) 
is a "no" instance of close-images(5) then we are promised that d > 2 — 6{m). Regardless 
of the state of the registers Xq and Xi sent to the verifier by the yes-prover, we must have that 
the state p G D(^) of the register Y sent to the no-prover is in either or Ai. Furthermore, 
we have 

Pr[p G A] = Pr[p G Ai] = ^. 

Hence, by the Distinguishability of Sets of States f Theorem 13. 3^ there exists a binary- valued 
POVM that correctly determines whether p G or p G with probability at least 

2 4 4 ■ 

The strategy for the no-prover is to perform the quantum measurement from Theorem 13.31 
and send the result to the verifier in step 3, which causes the verifier to reject with probability 
greater than 1 — □ 

3.4 Error Reduction for Short Quantum Games 

In this section we prove that short quantum games are at least partially robust with respect to 
error in the sense that the completeness error can be made exponentially small at the possible 
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cost of an increase in the soundness error and vice versa. Fortunately, because the short 
quantum game for CLOSE-IMAGES in Sect ion 1X51 has exponentially small soundness error, any 
increase in that quantity can be absorbed into the arbitrarily small factor, yielding a short 
quantum game for CLOSE-IMAGES with exponentially small completeness and soundness 
error. 

The error reduction technique we present in this section relies heavily upon previous 
results in error reduction for quantum interaction. We summarize the necessary material in 
Section 13.4.11 before proving our new result in Section 13.4.21 

3.4.1 Parallel Repetition and Transformations 

In Section 12.2.11 we mentioned that any quantum refereed game with reasonable error can 
be simulated by another quantum refereed game with exponentially small error that repeats 
the initial game many times in succession and then accepts based upon the outcomes of each 
of the repetitions. However, we pointed out in Section 11.2.51 that sequential repetition of 
this form necessarily increases the number of rounds in an interaction and so this technique 
does not apply to bounded-round interactions such as short quantum games. In the classical 
case, this problem was circumvented by identifying one-round refereed games with PSPACE. 
Unfortunately, no analogous result is known to hold for short quantum games. 

A natural approach to the task of error reduction for bounded-round interactions is to run 
many copies of the interaction in parallel and act as though the repetitions were sequential, 
basing the decision to accept accordingly. This technique, known as parallel repetition, 
is purely classical and has been successfully applied to classical single- and multi-prover 
interactive proof systems (see Raz [HTj and the references therein). A potential problem 
with this technique is that the provers need not treat each repetition independently — they 
might try to correlate the parallel repetitions (or entangle them in the quantum case) in some 
devious way such that the completeness or soundness error does not decrease as desired. 

In the quantum setting, the general case of this problem has not been completely solved. 
But for three-message single-prover quantum interactive proof systems with zero complete- 
ness error. Reference j^Ij proves that parallel repetition followed by a unanimous vote does 
indeed achieve the exponential reduction in soundness error that one might expect, regardless 
of any possible entanglement by the prover among the parallel copies. 

Because we will incorporate parts of the proof of this result into our reduction, it is 
necessary to summarize some of the additional formalism upon which it draws. Toward 
that end, recall that L(jF) and L(^) denote the sets of linear mappings acting on JF and Q 
respectively. As L(JF) and L(^) are themselves vector spaces, it makes sense to consider the 
set T(jF, ^) of linear mappings from L(jF) to L(^), also known as transformations. As one 
might expect, the Kronecker product extends naturally to transformations. 

Recall also that the spectral norm on L(jF) is induced by the Euclidean norm on JF by 
the relation 

II . II M^ll 

\\A\\ = sup — — r— 
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for every A G L(^)- We can extend the trace norm to T(jF, ^) in a similar way: for any 
T e T(J^, g) we have 

AeL(^)\{0} ll^lltr 

However, this extension of the trace norm does not induce an overly desirable metric on 
T(JF, Q) in part because its value can change upon taking the Kronecker product of a trans- 
formation with the identity transformation. That is, there exist Hilbert spaces Ti. and trans- 
formations T G T(JF, Q) with 

\\T\L^\\T®Iun)\l 

where Il{h) ^ T(?i,?i) is the identity transformation on L(?i). 

With this fact in mind, the diamond norm of a transformation T G T(jF, Q) is defined as 

I|t||,= ||t®/l(^)|L 

where dim(/C) = dim(jF). The diamond norm satisfies several convenient properties. For 
one, it is robust with respect to taking the Kronecker product with the identity. Another 
nice property of the diamond norm is that it is multiplicative with respect to the Kronecker 
product. In other words, 

||Ti®T2||, = ||Ti||J|T2||, 

for any choice of transformations Ti and T2. Proofs of these and other properties of the 
diamond norm can be found in Kitaev, Shen, and Vyali pUj . 

Now that we have introduced the diamond norm for transformations, we are ready to 
discuss its relevance to quantum interaction. In what follows, the projection Ilinit G Pos(5) 
is defined as 

Hinit = \0s){0s\ 

where \0s) is the initial pure state of any quantum interaction. The fact upon which we base 
our error reduction result is stated as follows (see Reference |Sl Lemma 7]): 

Fact 3.6. Let V{x) = (Vq, Vi) be a verifier for a one-round quantum interactive proof system 
on input x G {0, 1}* (such an interaction consists of a message from the verifier to the prover 
followed by the prover's response). Let T G T{^A ® V,Ai) be a transformation defined as 

T{X) = trv ((K)ni„it)X(nacccptl^i)) 

for every X G L(A^ (g) V). The maximum probability with which any prover could convince 
V to accept x is precisely ||T||^. 

As we shall soon see, if we consider the Kronecker product of T with itself many times 
then the multiplicative property of the diamond norm in concert with Fact 13.61 yields an 
exponentially small upper bound on the soundness error of repeated one-round quantum 
interactions. 
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3.4.2 A Partial Robustness Result 



In this subsection we prove that parallel repetition followed by a unanimous vote can be 
used to improve the error bounds for short quantum games by reducing the problem to error 
reduction for single-prover quantum interactive proof systems with three or fewer messages. 
The reduction is achieved by fixing a yes- or no-prover P{x) that is guaranteed to win with a 
certain probability. By viewing the verifier-prover pair {V, P){x) as a new composite verifier, 
we are left with what is now effectively a two-message quantum interactive proof system in 
which the opposing prover is the lone prover. We define a verifier-prover pair {V',P'){x) 
that runs many copies of (V, P){x) in parallel and accepts based upon a unanimous vote. We 
can then employ Fact 13.61 to prove that the error of the new game decreases exponentially 
in the number of repetitions. 

We are now prepared to give the main result of this section, whose proof is based upon 
the proof of Theorem 6 in Reference [HI] : 

Theorem 3.7 (Partial Robustness of Short Quantum Games). 

SQG(c, s) C SQG(fcc, s^) n SQG(c^ ks) 
for any choice of c, s : N ^ [0, 1] and k G poly. 

Proof. For brevity we write k = k{\x\), c = c{\x\), and s = s{\x\) where x G {0, 1}*. For any 
matrix A and any positive integer n, we write A®" = A ® • ■ ■ (g) A as shorthand for the n-fold 
Kronecker product of A with itself. 

We first prove that SQG(c,s) C SQG(A;c, s'^). Let L G SQG(c,s) and let V{x) = 
{Vq,Vi,V2) be a verifier witnessing this fact. Let V'{x) = {V^'' ,Vf^'' ,Vf'') be a verifier 
that runs k copies of the protocol of V{x) in parallel and accepts if and only if every one 
of the k copies accepts. We must show that V'{x) has completeness error at most kc and 
soundness error at most s^. 

First consider the case x G L. Let Y{x) = Yi be a yes-prover that convinces V{x) to 
accept X with probability at least 1 — c. Let Y'{x) = Y^'' be a yes-prover that runs k 
independent copies of the protocol of Y{x) in parallel. Then no no-prover can win any one 
of the k copies with probability greater than c and so by the union bound we know that the 
completeness error of the repeated game is at most kc. 

Next consider the case x ^ L. Let N{x) = Ni he a no-prover that convinces V{x) to 
reject x with probability at least 1 — s and let Ilinit be as defined in Section r3. 4. II As earlier 
intimated, we may view (V, N){x) = (Vq, V2iViVi) as a new one-round composite verifier and 
the yes-prover as the lone prover for some two-message quantum interactive proof system. 
Define the transformation 

T,(X) = trv^^^^^ ((Voni„iO^(nacceptV^2iVlV^l)) . 

By Fact 13.61 we know that the maximum probability with which any prover could convince 
(y,N){x) to accept x is ||Ts||^. As (y,N){x) has soundness error at most s, we have ||Ts||^ < 
s. 
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Now let N'{x) = Nf" be a no-prover that runs k independent copies of the protocol 
of N{x) in parallel. We now show that no yes-prover can win against N'{x) using verifier 
V'{x) with probability greater than s^. Let Il'j^it = Il^^f^ and Ilaccept = nfccept be the pro- 
jections corresponding to the initial and accepting states of the repeated game. Define the 
transformation 

nx) = tr(^^_^^^^)«. ((\/o'nU)x(nU,p,^'iv(y/)) . 

It is clear that T^' = T^^. By Fact 13. 61 and the multiplicativity of the diamond norm it follows 
that the maximum probability with which any prover could convince {V , N'){x) to accept 
X is 

||T-in|2 ||T-i0fc||2 ||2fc ^ k 

ll-^sllo — IPs lU ~ ll-^sllo — ' 

which establishes the desired result. 

Due to the symmetric nature of quantum refereed games, we can modify the above proof 
to show that SQG(c, s) C SQG{c'',ks). In particular, define the verifier V"{x) so that he 
rejects if and only if all k copies reject. For the case x ^ L, the proof that V"{x) has 
soundness error ks is completely symmetric to the proof that V'{x) has completeness error 
kc. 

For the case x G L, we let Y{x) = Yi be a yes-prover that convinces V{x) to accept 
with probability at least 1 — c. Let (V, Y){x) = {ViYiVq, V2) be a new one-round composite 
verifier for a two-message quantum interactive proof system in which the no-prover is the 
lone prover. The two differences here are that the prover's goal is now to convince (V", Y){x) 
to reject x instead of to accept x and that the transformation Tg is now replaced with the 
transformation 

Tc{X) = try {{V,Y,VoU,^,t)X{U,,^,M) . 

Fortunately, Fact 13.61 still applies and so the maximum probability with which any prover 
could convince (y,Y){x) to reject x is precisely HTdl^. That V"{x) has completeness error 
c'^ follows as before. □ 

Of course, the Partial Robustness of Short Quantum Games (Theorem 13. 7j) holds in the 
special case where the verifier V{x) = (/, Vi, V2) and so we obtain 

SQG,(c, s) C SQG,(fcc, s'') n SQG,(c^ ks) 

as an easy corollary. A more important corollary that follows from Theorems 13.51 and 13.71 is 
the main result of this chapter: 

Corollary 3.8. QIP C SQG,. 

Proof. Given a desired error bound 2~p where p G poly, choose e e 2-p''^y so that p{n)e{n) < 
2-Pin) ^ e p^. We have QIP C SQG,(|,e) C SQG,(2-p, 2"^). □ 
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Chapter 4 

An Upper Bound for Short Quantum 
Games 

Given that QIP is contained in both EXP j3T] and SQG* (Chapter E}, it is natural to wonder 
how complexity classes based upon short quantum games relate to EXP. In this chapter we 
prove that SQG C EXP, which is the main contribution of Reference |22j. 

In order to prove this containment, we build upon previously known techniques for sim- 
ulating quantum interaction with classical computation. In particular, Kitaev sketched an 
alternate proof [28j of the containment QIP C EXP We provide the first complete 

formalization of that proof and offer several extensions, one of which is that QRG C NEXP. 

Finally, we show that SQG C EXP by employing the accumulated results in a separation 
oracle for use with the ellipsoid method for convex feasibility. In fact, the containment 
SQG C EXP is a special case of a stronger result proven in this chapter. 

4.1 The Opt Problem 

In this section we define the computational problem opt based upon some observations re- 
garding quantum interactive proof systems. We show that OPT can be reduced to a semidef- 
inite program and hence admits a deterministic polynomial-time solution. 

4.1.1 Optimization, Transcripts, and Consistency 

Let c, s : N ^ [0,1], let L G QIP(c, s), let V{x) = {Vo,...,Vr) be an r-round verifier 
witnessing this fact, and consider the following optimization problem 

maximize || nacceptK-PrK-i ■ ■ ■ ViPiVo\0) f (4.1) 
subject to Pi,...,PreV{V(S)M). 

By definition, if x & L then the optimal value of this problem is at least 1 — c, whereas if 
X ^ L then the optimal value of this problem is at most s. Hence, if c and s are reasonable 
then L can be decided by solving this problem. 
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Figure 4.1: Transcript of a two-round quantum interactive proof 

However, the problem ()4.1|) in its stated form is incompatible with standard optimization 
algorithms. In this subsection, we define the notion of a "transcript" of a quantum interactive 
proof system and we identify every prover with such a transcript. In so doing, we reduce the 
optimization problem ()4.H1 to a much more manageable problem that can be solved using 
algorithms for semidefinite programming. 

Let P{x) = (Pi, . . . , Pr) be any r-round prover and consider the quantum circuit (V, P){x) 
for some input string x G {0, 1}*. For each i G {0, . . . ,r}, let pi G D(A^ ® V) denote the 
state of the verifier's qubits immediately before Vi is applied. The state pi can be viewed as 
a "snapshot" of the verifier's qubits at the beginning of the ith round of interaction. In this 
sense, the states po, . . . , pr indicate a complete transcript of the quantum interactive proof 
system. Such a transcript is illustrated in Figure ^3 for the case r = 2. 

What can be said about transcripts? Two observations follow immediately from the 
definition of a quantum interactive proof system. First, it must be the case that 

Po = |OA^,g,v)(OA^.S)v|, 

as the initial pure state of the entire system is always \0s). Second, the probability with 
which V{x) accepts x is given by 

tr (llaccept K-PrK- -^accept) ~ (K- ^acccpt^^^ccepiVr, Pr} 

in accordance with the rules for quantum measurement discussed in Section 11.3.41 

As a third observation, consider for each i G {1, ■ ■ ■ ,r} the states ^i,^- G D(V) of the 

verifier's private qubits immediately before and after the prover's circuit Pj is applied. These 

states are illustrated in Figure for the case r = 2. 

It is clear from Figures [4. II and that ^- is obtained from pi by discarding the message 

qubits. That is, 

C = trA4 (pi) ■ 

Similarly, is obtained from pj_i by applying Vi_i and discarding the message qubits. In 
other words, 

Finally, since the prover circuit Pi cannot act on the verifier's private qubits, it follows that 
— C (this fact is also made intuitively evident in Figure 1^^ . Hence, we claim that 

tiM (pi) = tiM (^i-iPi-i^i-i) V i G {1, . . . , r}. 
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Figure 4.2: Selected states in a two-round quantum interactive proof 



As a generalization of these observations, let JF and Q be Hilbert spaces, let ^^i, • • • , ^ 
Pos(jFcg)^) be positive semidefinite matrices, and let Aq, . . . , G L(jF(g)^) be arbitrary 
matrices. We say that the list Xi, . . . , is Q-consistent with Aq, . . . , Ar-i if 

trg (Xi+i) = trg {AiXiAD V « G {0, . . . , r - 1} 

where Xq = |Ojc-^g) (Ojc-^g|. Our goal then is to prove that a list of density matrices pi, . . . , pr 
indicates a valid transcript for a quantum interactive proof system with verifier V{x) if and 
only if it is A^-consistent with Vq, . . . , Vr-\- 

We require some additional formalism in order to accomplish this goal. For any positive 
semidefinite matrix X G Pos(jF) and any vector v ^ T ®Q vs, called a purification of X if 

X = tTg (VV*) . 

The purifications of X are related to one another as indicated by the following fact (see 
Hughston, Jozsa, and Wootters ^^)- 

Fact 4.1 (Unitary Equivalence of Purifications). A purification vGJ-'0QofXE 
Pos(jF) exists if and only if dim(^) > rank(X). Moreover, purifications of X are unitarily 
equivalent in the sense that ii u,v E ® Q are both purifications of X then there exists a 
unitary matrix U G U(^) such that (Jjr ® U)u = v. 

Intuitively, we make use of the Unitary Equivalence of Purifications (Fact 14. 1|) in the 
following manner. For any i G {1, . . . , r}, let u,u' G S be purifications of the states ^j, 4' £ 
D(V) in Figure ^21 The vectors u and u' can be thought of as the pure states of the entire 
system corresponding to the snapshots and ^j'. As ^.j = ^'i, it follows that u and u' are 
purifications of the same state and hence by the Unitary Equivalence of Purifications (Fact 
14. 1|) there exists a unitary matrix Pj G U(P ® A^) such that 

u' = {Pi ® Iv)u. 

The unitary matrix Pj indicates precisely the actions that the prover must take during the 
ith round of the interaction in order to take the pure state of the entire system from u 
to u'. Given any transcript pQ,...,pr, we can construct in this manner unitary matrices 
Pi, . . . ,Pr G \J{V ® Ai) corresponding to a prover P{x) who gives rise to that transcript. 
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We now formalize this intuition. Because our result will be applied in different contexts 
later in this chapter, we state it in its full generality and then follow its proof with a corollary 
that relates it to quantum interactive proof systems. 

Lemma 4.2 (Consistency Characterization). Let Aq, . . . , Ar-i G L(JF Q). For every 
Hilbert space Ti and every f/i, . . . ,Ur E U{Q ^Ti-) there exist Xi, . . . , X^. G Pos(jF(g)^) that 
are ^-consistent with Aq, . . . , Ar-i such that 

\\AUrAr-i---AiUiAo\0^^g^n)f = {A*A,Xr) \fAeL{J^®g). (4.2) 

Conversely, if dim(?-^) > dim(jF (g) Q) then for every Xi, . . . ,Xr G Pos(.7-' Q) ^-consistent 
with Aq,..., Ar-i there exist ?7i, . . . , G \]{Q (g) H) such that (lO) holds. 

Proof. We start by proving the first statement. Define mq, ...,'Ur G ® Q ® Ti and 
Xi, . . . ,Xr G Pos(jF (g) ^) as follows: for every i G {0, ... ,r — 1}, let Mj+i = Ui+iAiUi 
with Mo = |0) and let Xj+i = tr7^(Mj+i'U*_|_]^). Then for any A G L(jF (g ^) we have 

\\AUrAr-l---AiUiAo\0)f = \\AUrf = {A*A,UrK) = {A*A,Xr). 

It remains only to show the ^-consistency of Xi, . . . ,Xr with Aq, . . . , Ar-i. For every i G 
{0, . . . , r — 1} we have 

trg(Xj+i) = trg;^'H('Uj+iM*^J 

= trg^H(t^i+i^iMi<A*f^*+i) 
= trg;(AitrH(ujM*)v4i) 

= tTg{A,XiAi). 

To prove the converse, let 7i be a Hilbert space with dim(?i) > dim(jF (g Q) and let 
Xi, . . . ,Xr G Pos(jF (g ^) be ^-consistent with Aq, . . . , A^-i. Let Mq, . . . , G (g ^ (g 7i be 
purifications of Xq, . . . , X^ with uq = |0). These purifications are guaranteed to exist by the 
Unitary Equivalence of Purifications (Fact 14.11) because 

dim(7^) > dim(J^ G) > rank(X) 

for any X G L(jF (g Q). For every z G {0, ... ,r — 1}, it follows that AjMj is a purification 
of AiXiAi. As trg(Xj+i) = trg(y4jXj74*), the Unitary Equivalence of Purifications fFact l¥!T|) 
implies that there exists some unitary matrix Ui+i G IJ{Q (g TC) such that Uj+i = Ui^iAiUi. 
Again, we have 

\\AUrAr.i---AiUiAo\0)f = \\Aurf = {A*A,Uru;) = {A*A,Xr) 
for any A G L(J^® ^). □ 

The Consistency Characterization (Lemma 14. 2j) provides us with the ability to convert 
from a prover P{x) to a transcript pi, . . . , pr and vice versa. We use that ability in the 
following corollary to reformulate the optimization problem (14.11) . 
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Corollary 4.3. Let c, s : N ^ [0,1], let L E QIP(c,s), and let V{x) = (K), . . . , be a 
verifier witnessing this fact. Consider the following optimization problem 

maximize {|V^*n*j,^gp^.naccept Vr,Pr) (4.3) 
subject to pi, . . . , pr E D{A4 ® V) 

pi, . . . , Pr A^-consistent with Vq, . . . , K-i- 

If a; e L then the optimal value of this problem is at least 1 — c and ii x ^ L then the optimal 
value of this problem is at most s. 

Proof. If X E L then by definition there exist Pi, . . . ,Pr G \J{V ® A4) such that 

llnacccptKPrK-l ■ ■ ■ ViPiVolO) f > 1 " C. 

By the Consistency Characterization (Lemma 14. 2|1 there exists a transcript pi, . . . , that is 
Al-consistent with Vq, . . . , K-i such that 

(K*nLeptnacceptK, Pr) = \\ nacceptK^K-l " " " ^lPlK)|0) ||' , 

from which the first claim of the corollary follows. 

Now suppose X ^ L and let pi,...,pr be any transcript that is A^-consistent with 
Vo,...,K-i- By the Consistency Characterization (Lemma 14. 2|) there exists a prover 
P{x) = (Pi, . . . , Pr) such that 

<K*n:eceptnacceptK, Pr) = \\ nacceptK^rK-l " " " ^1^1^10) ||' . 

By definition, the quantity on the right is at most s. □ 

As Corollarv l4.3l suggests. any language in QIP can be decided by solving the optimization 
problem ()4.3p . Indeed, this entire section is dedicated to solving that problem efficiently. 

Like the Consistency Characterization (Lemma 14. 2|) . our solution to ()4.3|) will be used in 
several different contexts later in this chapter. Hence, we name the problem opt and restate 
it in full generality in Figure |331 It is assumed that the real and imaginary parts of all input 
numbers to OPT are represented in binary notation. 

As a final note, we observe that the optimization problem ()4.3|) appearing in the 
statement of Corollary 14.31 can be phrased as an instance of OPT with input matrices 
Vo, . . . , Vr-i, IlacceptK and a suitably small accuracy parameter e that depends only on the 
completeness error c and soundness error s. 

4.1.2 Semidefinite Programming 

Our proof that OPT admits a deterministic polynomial-time solution will rely upon existing 
polynomial-time algorithms for semidefinite programming. Hence, we offer a brief summary 
of semidefinite programming in this subsection. 
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Problem. OPT. 

Input. Matrices Aq, . . . ,Ar G L(jF (g) ^) and an accuracy parameter e > 0. 

Output. A list Xi, . . . , Xr G Pos(jF (g) Q) of positive semidefinite matrices that is Q- 
consistent with Aq, . . . , Ar-i such that 

{A:Ar,Xr) > {A;Ar,Zr)-e 

for every hst Zi, . . . , Zr G Pos(jF (g Q) that is ^-consistent with Aq, . . . , Ar-i. 



Figure 4.3: Definition of OPT 

Semidefinite programming is derived from linear programming, which is the name given to 
the problem of maximizing a linear function subject to a finite number of linear constraints. 
Given a Hilbert space JF, a Hermitian matrix H G H(jF), matrices Ai, . . . , Am G L(.F), and 
scalars ai, . . . , am G C, a semidefinite program over C has the form 

maximize {H,X) 

subject to {Ai, X) = ai for alH G {1, . . . , m} 
X G Pos(J^). 

The feasible set A C Pos(.F) is defined by 

A = {X e Pos(J^) : {Ai, X) = for alH G {1, . . . , m}} . 

The goal is to find a matrix X & A such that {H, X) is maximized over all X & A. Because 
both H and X are Hermitian, it follows that {H, X) is always real and so it makes sense to 
consider its maximal value. 

The semidefinite programming problem that we use is stated in Figure ^31 As with opt, 
it is assumed in this problem that the real and imaginary parts of all input numbers are 
represented in binary notation. The SDP problem can be solved in time polynomial in the 
bit length of the input data using interior point methods (see, for example, Nesterov and 
Nemirovskii ^36^)- 

4.1.3 A Semidefinite Program for Opt 

Our goal in this subsection is to prove that OPT can be reduced to SDP and therefore 
has a deterministic polynomial-time solution. We accomplish this goal by formalizing the 
reduction that appears implicitly in Reference [2H] • The main idea is to "stack" the positive 
semidefinite matrices Xi, . . . ,Xr G Pos(jF Q) into one large block-diagonal matrix. This 
stacked matrix will serve as the variable over which SDP is to optimize. 
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Problem. SDP. 

Input. A Hermitian matrix H e YL{T), matrices Ai,...,Am £ L(^) and scalars 
Oil, . . . , G C defining the feasible set A, a feasible solution Xi^it £ a positive 
real number h such that < 6 for every X ^ A, and an accuracy parameter £ > 0. 

Output. X e A such that {H, X) > {H, Z) - e for every Z e A. 



Figure 4.4: Definition of SDP 



Given matrices ^40, . . . , ^r-i ^ ^{J^ ®Q)-i we construct linear equality constraints on the 
stacked matrix variable that characterize ^-consistency with Aq, . . . , Ar-i- Since the equality 
conditions describing the ^-consistency of Xi, . . . are already linear in those matrices, 
this construction is largely a technical exercise that expresses those conditions in a way that 
is compatible with the stacked matrix variable. 

Toward that end, we introduce some new notation. For any Hilbert space 7i we let 
El^ e denote the matrix with all entries equal to zero except for a 1 in the [i, j] entry. 

It follows that B[i,j] = {Et;}, B) for any B e LC^). 

For any positive integer n we let 7i®" denote the Hilbert space with dimension n dim(H). 
For any matrices Bi, . . . ,Bn G i^iTi-) we let {Bi, . . . , e L(?i®") denote the block-diagonal 
matrix 

/ Si \ 



V Bn J 

Letting TZ—{!F® Q)®'^^^, we start by describing linear equality constraints that ensure 
every feasible solution X & Ac Pos(7^) is a block-diagonal matrix of the form (Xq, . . . , X^) 
for some Xq, . . . , G Pos(jF(g)^). For this task, the "brute force" method of simply forcing 
every off-block-diagonal entry to zero works just fine. In other words, we require that 

(E;^^x> = o 

for all suitably chosen i and j. Using this same brute force technique, we set every entry of 
Xq to indicate the matrix |0)(0|. 

We require additional notation before we can proceed to the ^-consistency constraints. 
Define 

S,:L((^®^;)®2)^L(7^) 
for all A; e {0, . . . , r - 1} so that, given C = (Ci, C2) G L((:r ® Q)®'^)^ we have 

/o ... 0\ 



Ci 
C2 



block k 
block k + l 



0/ 
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That is, C is embedded into the all-zero matrix so that if X = (Xq, . . . , X^) is block-diagonal 
then 

(Sfc(C),X) = (C, (Xfc,X,+i))- 

We also define 

for all z, j G {1, . . . , dim(jF)} so that, given A G L(jF (g) ^), we have 



^ ^^^"V -E'^^Ig) 



We now prove the following lemma. 

Lemma 4.4 (^-Consistency Constraints). Let X = {Xq, . . . ,Xr) G Pos(7^) be a block- 
diagonal matrix with Xq = |0)(0|. Then the list Xi, . . . , X^ is ^-consistent with Aq, . . . , Ar-i 
if and only if X satisfies 

{Ekir'\Ak)),X) = 
for all z, j G {1, . . . , dim(jF)} and all A; G {0, . . . , r — 1}. 

Proof. We have 

{Ek{r'^{Ak)),x) = (r'^'(Afe),(Xfc,x,+i)) 

= {Al ® Ig) Ak, Xu) - ® Jg, Xfe+i) 

= ® Jg, AfeXfcA*) - ® Jg, Xfc+i) 

= (E>^trg(A,XfeA*)) - (E>^trg(Xfc+i)) 
= iYg{AkXkAl)[l,j]-ilg{Xk+i)[l,j]. 

Of course, trg(74fcXfcA^) = trg(Xfc+i) if and only if their entrywise difference is zero, from 
which the lemma follows. □ 

The ^-Consistency Constraints (Lemma 14. 4j) are based upon similar constraints found in 
Reference [30] • We have thus established a polynomial number of linear equality constraints 
that characterize ^-consistency. Our next task is to bound the feasible set A C Pos(7?.) of 
matrices that satisfy these constraints. 

Lemma 4.5 (^-Consistency Constraint Bound). Let X = (Xo,...,Xr) G Pos(7^) be 
a block- diagonal matrix with Xq = |0)(0| such that the list Xi, . . . ,Xr is ^-consistent with 
Aq, . . . , Ar-i. Then 
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Proof. It is clear that ||Xo|| = 1 and that ||X|| is just the maximum of over all 

i G {0, . . . ,r}. Hence, it remains only to bound \\Xi\\ for i > 1. Let 7i be a Hilbert space 
with dim(7i) = dim(jF(g)^). By the Consistency Characterization f Lemma 14. 2|) . there exist 
Ui,...,Uie lJ{g (g) n) such that 

II AU.A^i ■ ■ ■ AiUiAo\0:F^g^n) f = {A* A, X,) \f A e ® Q). 

In particular, 

\\IU,A_, - ■ ■ A,U^Ao\0)f = {ri,X,) = tT{X,) > \\x,\\ 
where the final inequality follows from the fact that Xj is positive semidefinite. That 

\\IU,A_, - ■ ■ A,U,Ao\0)\f <l[\\A,f 

j=0 

follows from the fact that Ui, . . . ,Ui are unitary. □ 

We have now developed the tools needed to prove the following theorem. 

Theorem 4.6. OPT can be solved in time polynomial in the bit length of the input data. 

Proof. The proof is by reduction to SDP. Given inputs Aq, . . . ,Ar and e to OPT, we construct 
inputs to SDP as follows: 

• The error parameter e is passed unchanged from OPT to SDP. 

• The objective matrix H G H(7?.) is the block-diagonal matrix (0, . . . , 0, A*Ar). 

• The linear equality constraints are the ^-Consistency Constraints (Lemma 14. 4p . 

• The bound b for all feasible solutions is given by the ^-Consistency Constraint Bound 
(Lemma 14. 5|) . Note that if Aq, . . . , A^—i are unitary then we have 6=1. 

• The initial feasible solution Xinit G A can be taken to be the block-diagonal matrix 
(Xo, . . . , X,) where X^+i = AiXiA* for every i G {0, . . . , r - 1} with Xq = |0) (0|. This 
feasible solution corresponds to a prover who always acts trivially upon his qubits. 

□ 



4.2 Some Upper Bounds 

In this section we use our polynomial-time solution to OPT (Theorem 14. 6|) to prove the 
upper bounds QIP C EXP and QRG C NEXP. Indeed, these containments are special cases 
of stronger results proven in this section. 

Several details must be considered before we can formalize these containments. For ex- 
ample, it is prudent to discuss numerical error introduced by finite-precision approximations 
of continuous quantities. In the case of quantum refereed games, we also require a tractable 
bound on the number of qubits used by the provers. 
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4.2.1 Roundoff Error 



Let L G QIP and let V{x) = (Vq, . . . , K) be a verifier witnessing this fact. In Section E.l.ll we 
pointed out tfiat L can be decided by solving opt with input matrices Vq, . . . , K-i, HacceptK 
and a small enough accuracy parameter e. However, it is often the case that the unitary 
matrices Vo,...,K £ U(A^ ® V) associated with the verifier's quantum circuits contain 
entries that are complicated algebraic expressions involving irrational numbers. Because 
OPT was defined to accept input matrices whose entries are expressed in binary notation, 
it follows that the best we can do is approximate Vq, . . . , with finite-precision matrices 
Vo,...,Vre L{M(S)V). 

Our intuition tells us that, by choosing a suitable level of precision with which to express 
VQ,...,Vr, the induced verifier V{x) will always have reasonable completeness error and 
soundness error. Moreover, we expect that matrices Vq, . . . , K with the required level of 
precision can be computed efficiently, so that L can still be decided in exponential time. 
Indeed, these intuitions are correct. This subsection is dedicated to arguing that accurate 
enough approximations can be computed efficiently. For simplicity, we restrict our discussion 
to quantum interactive proof systems, but much of the discussion in this subsection transfers 
to quantum refereed games without complication. 

In Section 11.3.31 we stipulated that all quantum circuits in this thesis are composed of 
quantum gates chosen from some finite universal set. We take it as given that the unitary 
matrices associated with the quantum gates in this universal set can all be computed so that 
each entry is accurate to t bits of precision in time polynomial in the bit length of t. Of 
course, the unitary matrix associated with any single quantum gate is readily extended to a 
larger Hilbert space by taking the Kronecker product with the identity matrix as usual. 

Since the verifier's quantum circuits are generated uniformly in polynomial time, it follows 
that each of the r(|a;|) circuits is composed of at most quantum gates for some r,g E 

poly. For each k E {0, . . . , r} and Z G {1, . . . ,g} let Uk^i G IJ{A4 ® V) be the unitary matrix 
associated with the Ith gate in the verifier's kth quantum circuit, extending to ® V so 
that Vfc = Uk,g---Uk,i. ^ 

Next, suppose that Uk^i is an approximation of Uk,i such that each entry of Uk^i is accurate 
to t bits of precision and let Vk = Uk,g ■ ■ ■ Uk,i- Finally, let P{x) = (Pi, . . . , Pr) be any prover. 
The probability p with which (V, P){x) accepts x is precisely 

P = llnacceptKPrV;.-! " ' " V^lPlV^,|0) f 

and the probability p with which {V, P){x) accepts x is precisely 

P = llnacceptKPrK-l ■ ■ ■ ViPiVolO) f . 

Our goal is to prove an upper bound on the difference |p — p| in terms of t. 

Toward that end, let 5 > and let A,Ae L(^) be any matrices whose entrywise 
difference is at most 6. In other words, 



A[t,j]- A[t,j] 



< 6 
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for every i,j e {1, . . . , diin(J^)}. It is not difficult to show tfiat 



A|| < dim(J^)5. 

Tfie following lemma allows us to deduce the accuracy required of our approximations. 

Lemma 4.7. Let 5 > and let Ai, . . . , A^, Ai, . . . , A^n be any matrices such that the 
product A^ ■ ■ • Ai is defined and, for alH e {1, . . . , m}, A^ has the same dimensions as A^, 
\\Ai - Ai\\ < 5, and || || A|| < 1- Then 



and 



Proof. We have 



Am • • • Ai \\Ajn ■ ■ ■ Ai 



\ A . . . 4 J|2 _ II I . . . Jj|2 
l^m ^1|| ll^m ^1|| 



< mS 



< 2mS. 



Am ' ' ' Ai \\Am ■ ■ ■ Ai 



^ \\Am ■ ■ ■ Ai — Am ■ ■ ■ A\ 



i=l 



'■m 

i=l 
m 

^ ^ ] II ■ ■ ■ -^i 

i=l 
m 



By repeated application of the triangle inequality, this quantity is at most 

m 

^ ] 1 1 Am • • • AiAi_i ■ ■ ■ Ai — Am ■ ■ ■ Aij^iAi ■ ■ ■ Ai 
1 

m 

^ ] II ■ ■ ■ ~ Ai)Ai_i ■ ■ ■ Ai 

j+1 II II ~ II II ' ' ■ ^1 I 

< ^11 A - All < "mS. 



i=l 



The lemma follows from the fact that 

- b'^^ = \a-b\{a + b) <2\a-b\ 
whenever a and b are real numbers in the interval [0, 1]. 



□ 



Since the verifier's quantum circuits are generated uniformly in polynomial time, it follows 
that they each act on at most q{\x\) qubits for some q e poly, so that dim(Al <SiV) — 2^. As 
each entry of IJk,i is accurate to t bits of precision, we have 



Uk,i[hj] - Uk,i[iJ] 



< T 
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for every i,j G {1, . . . , 2'^} and hence 

\\Uk,i-Uk,i\\<^'''- 

It follows from Lemma f4. 71 that 

\p-p\< (r + 1)^2^-*+^ 

Hence, we can compute an exponentially close approximation p of p by choosing a suitable 
t G poly and approximating each matrix Uk^i to t(|a;|) bits of precision. In fact, this result 
holds even if r and g grow exponentially in 

4.2.2 An Extension of QIP C EXP 

We are now ready to prove the upper bound QIP C EXP. Indeed, we prove that the contain- 
ment holds under the following relaxations of the definition of QIP: 

• The verifier may exchange an exponential number of messages with the prover. 

• The verifier's quantum circuits may contain an exponential number of gates, so long 
as they still act upon at most a polynomial number of qubits. 

• The completeness error and soundness error may be exponentially close to | in 

We define a strong verifier to be a verifier whose quantum circuits are generated by an 
exponential-time Turing machine on input x, but they act on at most a polynomial number 
of qubits. 

Theorem 4.8 (An Extension of QIP C EXP). Let c, s : N ^ [0, 1] be any polynomial-time 
computable functions satisfying 1 — c{n) — s{n) > for all n G N. Any language L C {0, 1}* 
that can be decided by a quantum interactive proof system with a strong verifier having 
completeness error c and soundness error s is in EXP. 

Proof. We assume without loss of generality that c{n), s{n) < ^ for all n G N, as any verifier 
who can compute c{\x\) and s{\x\) can also bias his final decision to satisfy this condition. Let 
e = min {|~c, | — s}. It follows from the fact that c and s are polynomial-time computable 
that e G 2-P"^y. 

Figure 14.51 describes a deterministic exponential-time algorithm that decides L. To see 
that this algorithm is correct, let p (respectively p) denote the maximum probability with 
which V{x) (respectively V{x)) can be made to accept x. By our choice of accuracy param- 
eter for OPT we have |ti7 — p| < | and by Lemma f4. 71 we have 

e e 

\p — p\ < 2(r + 1)— = -, 

1^ ^1 V M(r + 1) 2' 

from which it follows that |ct7 — p| < e. By definition, if x G L then p > ^ + e and hence 
> |. Conversely, ii x ^ L then p < ^ — e and hence vj < ^. 
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1. 



Run the exponential-time Turing machine that generates the verifier's quantum circuits 
on input string x G {0, 1}*. Let V{x) = (Vq, . . . , K-) denote the unitary matrices 
associated with these circuits. 



2. Compute an approximation V{x) = (Vq, . . . , Vr) of V{x) satisfying 

\\Vi-VA\< ^ 



4(r + 1) 

for every i G {0, . . . , r}. 

3. Solve OPT with input matrices Vq, . . . , HacceptK- and accuracy parameter |. Let 
zu denote the optimal value indicated by this solution. Accept x ii w > |, otherwise 
reject x. 



Figure 4.5: An exponential-time algorithm for L G QIP 

It remains only to verify that this algorithm runs in exponential time. According to 
Section 14.2. the approximation V{x) in step 2 can be computed in exponential time by 
choosing a suitable t G poly and approximating the unitary matrices associated with each of 
the verifier's quantum gates to t{\x\) bits of precision. As the input matrices to OPT in step 
3 can be computed in exponential time and have at most exponential dimension, the desired 
result follows from the fact that opt admits a polynomial-time solution (Theorem 14. (jj) . □ 

4.2.3 Bounding the Number of Prover Qubits 

In this subsection we look at extending the proof of QIP C EXP f Theorem 14. 8|) to provide 
an upper bound for QRG. 

We begin by applying the Consistency Characterization (Lemma I4.2|l to quantum refer- 
eed games in much the same way as it was applied to quantum interactive proof systems in 
Corollarv 14.31 in Section [4.1.11 In particular, if the yes-prover Y{x) is fixed then the combi- 
nation of V{x) and Y{x) can be viewed as a new verifier (V, Y){x) for an ordinary quantum 
interactive proof system in which the no-prover is the only prover. In this case, the actions 
of the no-prover can be described by a transcript, just as with quantum interactive proof 
systems. Such a transcript is illustrated in Figure 14.61 In this case, we use the Consistency 
Characterization (Lemma 14. 2j) to convert from a no-prover N[x) to a transcript pi, . . . , pr 
and vice versa. 

Corollary 4.9. Let c, s : N ^ [0, 1], let L G QRG(c, s), let V{x) = {Vq, . . . , K) be a verifier 
witnessing this fact, and let Y{x) = {Yi, . . . ,Yr) be a yes-prover. Consider the following 
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Figure 4.6: Transcript of a two-round quantum refereed game 

optimization problem 

maximize {Y*V*Il*^j^^^Ilre}ectVrYr, pr) (4.4) 
subject to pi,. . . ,pr e'Diy ® My ®V ® Mn) 

pi, . . . , Pr M TV-consistent with Vq, ViYi, . . . , K-i^r-i- 

If X G L then there exists a yes-prover Y{x) such that the optimal value of this problem is 
at most c and if x ^ L then for every yes-prover Y[x) the optimal value of this problem is 
at least 1 — s. 

Proof. If X ^ L then by definition there exist Ni, . . . , Nr G \J{Mn ® A/") such that 

||n,ejectV;y;iV.K-l ■ ■ • ViYiNiVo\0) f>i-s 

for every Yi, . . . ,Yr ^ U(3^(8> A^y). By the Consistency Characterization f Lemma 14. 2|) there 
exists a transcript pi, . . . , that is M Ar-consistent with Vq, ViYi, . . . , such that 

(r;\/;n:,j,,,n,ejectv;i;,p.> = \\u,,^ectVrYrNrVr.^ - ■ ■v,y,n,Vo\o)\\\ 

from which the second claim of the corollary follows. 

Now suppose X E L, let Y{x) = (Yi, . . . , Yr) witness this fact, and let pi, . . . , p^ be any 
transcript that is Ar-consistent with Vq, ViYi, . . . , Vr-iYr-i. By the Consistency Charac- 
terization fLemma 14. 2j) there exists a no-prover N{x) = {Ni, . . . , A^^) such that 

(F;v;*n;j,,tnrejectv;y.,p.> = ||n,ejectV;>;iv.v;_i---ViriiViK)|o)||'. 

By definition, the quantity on the right is at most c. □ 

Corollarv 14.91 suggests that any language in QRG can be decided by nondeterministically 
"guessing" the yes-prover Y{x) = {Yi, . . . ,Yr) and solving the optimization problem ()4.4|1 . 
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Given a verifier V{x) and a yes-prover Y{x), this problem can be phrased as an instance of 
OPT with input matrices 

Vq, ViYi, . . . , Vr-lYr-i, HrejectK-^r (4-5) 

and a suitably small accuracy parameter e that depends only on the completeness error c and 
soundness error s. As OPT admits a deterministic polynomial-time solution (Theorem I4.(j|l . 
it is tempting to conclude that any language in QRG can also be decided in nondeterministic 
exponential time. 

However, we must take care to ensure that the size of the induced instance of OPT is in 
fact bounded by an exponential in The input matrices (j4.5j) act upon the Hilbert space 
y ® A4y ® V ® tMtv: as the quantum circuits belonging to any prover are unbounded, it is 
conceivable that the yes-prover uses a superpolynomial number of private qubits. In this case, 
the dimension of y and hence of the input matrices ()4.5|) to OPT may be superexponential 
in In order to achieve the desired upper bound for quantum refereed games, we require 
a polynomial bound on the number of qubits used by the yes-prover. 

As far as quantum interactive proof systems are concerned, it follows from the Consistency 
Characterization fLemma 14. 2|) that the prover 's Hilbert space V need only satisfy dim('P) > 
dim(A^ ® V). In other words, any quantum interactive proof system can be simulated by 
another quantum interactive proof system in which the prover uses no more qubits than 
the verifier. Unfortunately, this convenient bound is not known to extend to quantum 
interactions with multiple provers. 

Fortunately, there is a looser polynomial bound that does hold for quantum interactions 
with multiple provers. In particular, the following fact holds (see Kobayashi and Matsumoto 

my- 

Fact 4.10. In any quantum interaction, the number of qubits required by each of the provers 
is polynomial in the number of message qubits shared with the verifier and the number of 
rounds in the interaction. 

Hence, if both the number of message qubits and the number of rounds in the interaction 
are polynomial then any prover in a quantum refereed game can be assumed to use a polyno- 
mial number of qubits. In particular, the Hilbert space 3^ corresponding to the yes-prover's 
private qubits has dimension at most exponential in |x| as desired. 

4.2.4 An Extension of QRG C NEXP 

In this subsection we prove the upper bound QRG C NEXP. Indeed, we prove that the 
containment holds under the following relaxations of the definition of QRG: 

• The verifier's quantum circuits may contain an exponential number of gates, so long 
as they still act upon at most a polynomial number of qubits. 

• The completeness error and soundness error may be exponentially close to | in |a;|. 
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It is interesting to note that the containment QRG C NEXP is not known to hold for quan- 
tum refereed games with a superpolynomial number of rounds. By contrast, we showed in 
Theorem 14.81 that the containment QIP C EXP holds even when the number of rounds is 
exponential. As explained in Section 14.2.31 this strange discrepancy is brought on by the 
conditions of Fact 14.101 

Theorem 4.11 (An extension of QRG C NEXP). Let c, s : N — > [0, 1] be any polynomial- 
time computable functions satisfying 1 — c{n) — s{n) > for all n G N and let r G poly. 
Any language L C {0, 1}* that can be decided by a quantum refereed game with a strong 
r-round verifier having completeness error c and soundness error s is in NEXP. 

Proof. As in the proof of Theorem 14.81 we assume without loss of generality that c, s < | 
and we let e G 2"^"'^ be defined hj e = min {|^c, | — s}. 

The nondeterministic step of our solution is to guess the unitary matrices Y{x) = 
(Yi, . . . , Yr) belonging to the yes-prover and compute and approximation Y{x) = (Yi, . . . , Yr) 
of Y{x) satisfying 

II y. - y.|| < f 

4(2r + l) 

for every i G {1, . . . , r}. This step can be accomplished in many different ways. For example, 
any unitary matrix U is given by exp{iH) for some Hermitian matrix H. To guess the entries 
of U accurate to t bits of precision, we first choose a suitable t' > t, guess the entries of H 
to t' bits of precision, and run any stable algorithm that computes the matrix exponential 
(see, for instance, Golub and Van Loan [201 )• 

The deterministic step of our solution is to run the algorithm of Figure 1^31 in Theorem 
with the following changes: 

• The approximation V{x) in step 2 must satisfy 

\\V,-VA\< ^ 



4(2r + 1) 

for every z G {0, . . . , r}. 

• In step 3 we solve OPT with input matrices Vq, ViYi, . . . , Vr-iYr^i, IlrejectK^ and we 
reject x if zu > ^, otherwise we accept x. 

To see that this algorithm is correct, let p denote the maximum probability with which 
V{x) can be made to reject x given yes-prover Y{x). That |ro — p| < e follows just as in 
Theorem 14.81 By definition, if a; G L then there exists a yes-prover Y{x) such that p < ^ — e 
and hence zu < ^. Conversely, if a; ^ L then for all yes-provers we have p > | + e and hence 

That this nondeterministic algorithm runs in exponential time follows as in the proof of 
Theorem 14.81 □ 
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Figure 4.7: Transcript of a short quantum game 



4.3 The Ellipsoid Method and Short Quantum Games 

In this section we prove SQG C EXP. Indeed, this containment is a special case of a stronger 
result proven in this section. 

Given a verifier for a short quantum game, we construct a convex set of matrices that is 
nonempty if and only if there exists a winning yes-prover for that game. The desired result 
is achieved by providing an algorithm that determines in exponential time whether or not 
this set is empty. 



4.3.1 The Set of Winning Yes-Provers 

The key fact that we exploit in order to put SQG inside EXP is that the no-prover does 
not become involved in any short quantum game until the verifier has finished exchanging 
messages with the yes-prover. Because of this fact, the actions of the yes-prover prior to the 
no-prover's involvement can be completely described by a transcript, just as with quantum 
interactive proof systems. As the verifier exchanges only one message with the yes-prover, 
the transcript under consideration consists only of the state pi e D{My ® V ® A4n ® A/") 
illustrated in Figure UTI 

We begin by applying the Consistency Characterization f Lemma 14. 2|) to short quantum 
games in a way that identifies the set of winning yes-provers Y{x) = {Yi) with a set of 
winning transcripts pi. 

Corollary 4.12. Let c, s : N ^ [0,1] satisfy 1 - c{n) - s{n) > for all G N, let L G 
SQG(c, s), and let V{x) = (Vo, Vi, V2) be a verifier witnessing this fact. Define Win(V, c) to 
be the set of all pi G D(A1y ® V ® A^at ® A/") such that pi is A^l y-consistent with Vq and 

{V,*N*V*U:^^,,,U,,^ectV2N,VuPi) <c V ATi G V{Mn ® AT). 
Then Win(y, c) is nonempty if and only if a; G L. 
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Proof. If X G L then by definition tliere exists Yi G U {y ® Aiy) such that 

||nreject^2iVl^l>^lK)|0)f <C 

for every A^i G U(A^Ar (S'A/'). By the Consistency Characterization (Lemma I4.2p there exists 
a transcript pi that is A^y-consistent with Vq such that 

from which it follows that pi G Win(V, c). 

If X ^ L then let N{x) = (Ni) witness this fact and let pi be any transcript that is 
A^y-consistent with Vq. By the Consistency Characterization (Lemma 14. 2|) there exists a 
yes-prover Y{x) = (Fi) such that 

By definition, the quantity on the right is at least 1 — s > c, from which it follows that 
pi ^ Win( V, c) □ 

As Corollary 14. 121 suggests, any language L G SQG can be decided by an algorithm that 
decides the emptiness of the set Win(V, c). But how can the emptiness of this set be decided 
efficiently? 

In order to answer that question, we point out that once a yes-prover has been fixed the 
short quantum game essentially becomes a two-message quantum interactive proof system in 
which the no-prover is the only prover. As demonstrated in Section l^?T| such an interaction 
can be decided by solving opt. Therefore, if we are given a candidate transcript pi for 
some yes-prover Y{x) then we can use our solution to OPT to decide whether there exists 
a no-prover that wins against Y{x). If we find that no such no-prover exists then we can 
safely conclude that pi G Win(V, c) and hence x E L. 

Unfortunately, if we find that there does exist a no-prover that wins against Y{x) then 
we cannot immediately conclude that x ^ L because it might also be the case that x G L 
but Y{x) is a bad yes-prover who does not properly witness this fact. 

However, all is not lost: using our solution to OPT it is easy to recover the unitary matrix 
Ni G U(A^Ar ® A/") belonging to a no-prover who wins against Y{x). This unitary matrix 
satisfies 

but by the definition of Win(y, c) we have 

(V;Ar*V^;n:,j,,,n,ejectV^2A^iV^i, P> < c V p G Win(V^, c) 

and hence A^i is in some sense a witness to the fact that pi Win{V,c). In particular, it 
follows from these inequalities that the matrix V"j^*A'^V2*n*gjg^^nrejectV2A'iVi and the scalar c 
define a hyperplane that separates pi from Win(V,c). 

To summarize the ideas presented thus far, we have that if a given density matrix pi is 
an element of Win(V, c) then this fact can be verified efficiently by solving opt. Otherwise, 
if pi ^ Win(V, c) then we can use our solution to opt to construct a hyperplane separating 
pi from Win(V, c). Later we will see that these two abilities can be used to efficiently decide 
the emptiness of Win(V, c) via convex feasibility methods such as the ellipsoid method. 
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4.3.2 Double Quantum Interactive Proof Systems 



Before we formalize the ideas presented in Section [4.^.11 it is instructive to note that those 
ideas apply to a slightly larger subclass of quantum refereed games. Suppose, for example, 
that p is the state of the verifier's qubits after exchanging not just one, but several messages 
with the yes-prover. Presumably, the same method can still be used to determine whether 
p indicates a winning yes-prover. The only complication is that it must be possible for the 
yes-prover to somehow get the verifier's qubits into the state p. Fortunately, the Consistency 
Characterization f Lemma 14. 2|) tells us precisely when this task is possible. 

Of course, once p is given and the yes-prover is fixed there is no reason to restrict the 
induced quantum interactive proof system to only two messages — our solution to OPT will 
easily handle the case in which the verifier exchanges many messages with the no-prover. 
The only complication here is how to generate a separating hyperplane using the output of 

OPT. 

With that extension in mind, consider a short quantum game in which the verifier ex- 
changes not just one message with each prover, but ri messages with the yes-prover followed 
by r2 messages with the no-prover before making his decision. One can think of a quantum 
refereed game of this strange form as two consecutive quantum interactive proof systems — 
one with the yes-prover, then one with the no-prover. Hence, we give the name double 
quantum interactive proof system to quantum refereed games that obey this protocol and we 
let DQIP(c, s) denote the complexity class of languages that have double quantum interactive 
proof systems with completeness error c and soundness error s. 

Like short quantum games, it is still the case with double quantum interactive proof 
systems that the no-prover does not become involved until the verifier has finished exchanging 
messages with the yes-prover. Hence, it is still the case that actions of the yes-prover can be 
completely described by a transcript. This time, however, the transcript consists of several 
states pi, . . . , pr^ instead of just a single state. 

We apply the Consistency Characterization f Lemma 14. 2j) to double quantum interactive 
proof systems in much the same way as it was applied to short quantum games in Corollary 
14.121 That is, we identify a set of winning yes-provers Y{x) = (Yi, . . . with a set of 
winning transcripts pi, . . . , p^^. 

Corollary 4.13. Let c, s : N ^ [0, 1] satisfy 1 - c(n) - s{n) > for all n G N, let L G 
DQIP(c, s), and let V{x) = (Vq, . . . , Ki, Wi, . . . , Wr^) be a (ri -|- r2)-round verifier witnessing 
this fact. Define Win(V, c) to be the set of all transcripts pi, . . . , Pn G 'D{MY®V^M.N^-^f) 
such that pi, . . . , pri is A^y-consistent with Vq, . . . , K-i-i and 

{D*D,pr,)<c 

for all D of the form 

D = Il,,^,,,Wr,Nr,Wr,-l ■ ■ ■ W,N,Vr, (4.6) 

for some unitary matrices Ni, . . . , Nj.^ G \J{Ai n ® A/"). Then Win(V^, c) is nonempty if and 
only if x G L. 
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Proof. If X G L then by definition tliere exists Yi, . . . , 1^.^ G U(3^ ® M.y) such that 

\\DYr,Vr,.i---ViY^Vo\0)f <c 

for every D of the form (j4.6p . By the Consistency Characterization f Lemma 14. 2p there exists 
a transcript pi, . . . , that is A^y-consistent with Vq, . . . , Ki-i such that 

{D*D,pr,) = \\DYr,Vr,-i---V,Y,Vo\0)f, 

from which it follows that the transcript pi, . . . , p^^ is an element of Win(V, c). 
If X ^ L then let N{x) = {Ni, . . . , Nr2) witness this fact, let 

and let pi, . . . , p^j be any transcript that is Aly-consistent with Vq, . . . , K^-i. By the Con- 
sistency Characterization f Lemma 14. 2j) there exists a yes-prover Y{x) = (Yi, . . . ,l^ri) such 
that 

{D*D, p,,) = II DYr.,Vr,.i ■ ■ ■ ViFiVolO) II' . 

It follows from our choice of D that the quantity on the right is at least 1 — s > c and hence 
the transcript pi, . . . , p^^ is not an element of Win(V, c). □ 

Just like Corollarv l4.121 Corollarv l4. 13l suggests that any language with a double quantum 
interactive proof system can be decided by ascertaining the emptiness of Win(V,c). Our 
intention is to solve this problem by extending the ideas of Section l4.3.1l to double quantum 
interactive proof systems. That is, given a transcript pi, . . . , p^^ for some yes-prover Y{x), we 
check to see if there exists a no-prover who wins against Y{x) by solving a certain instance 
of OPT. If such a no-prover exists then we use our solution to OPT to construct a hyperplane 
separating the transcript pi, . . . , Pn from the set Win(y, c) of winning transcripts. Given 
the ability to construct separating hyperplanes, we will see that the emptiness of Win(V", c) 
can be determined via the ellipsoid method. 

4.3.3 The Ellipsoid Method 

The problem of ascertaining the emptiness of a convex set is sometimes called convex feasi- 
bility. This problem is a special case of the convex programming problem, wherein the task 
is to maximize a given convex function over some convex set of feasible solutions. Convex 
programming is a generalization of both the linear and semidefinite programming problems 
mentioned in Section 14.1.21 In the case of convex feasibility, no function is given and the 
goal is only to determine whether or not the set of feasible solutions is empty. 

The ellipsoid method is an iterative procedure that can often be used to solve the convex 
feasibility problem in polynomial time. Most of our discussion concerning this method is 
based upon material found in the book by Grotschel, Lovasz, and Schrijver |2Ij. The ellipsoid 
method has a rich history that we do not survey here. The interested reader is referred to 
the aforementioned book for a concise account of this history up until 1988. 

The method can be described informally as follows. Given a set ^ C R" such that 
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• ^ is bounded and convex; and 

• if ^ is nonempty then ^ is a full-dimensional subset of M", 

we wish to decide whether A is empty. One iteration of the ellipsoid method consists of the 
generation of a candidate element x G M". If x is found to belong to A then the algorithm 
terminates, having found a certification that A is nonempty. Otherwise, the convexity of A 
implies that there exists a hyperplane that separates x from A [211 ■ This hyperplane is used 
by the ellipsoid method to generate a refined candidate x' G M" during the next iteration. 
If an appropriate number of iterations pass without finding a vector in A then the ellipsoid 
method terminates with the conclusion that A must be empty. 

The ellipsoid method is an oracle algorithm in the sense that it does not produce the 
separating hyperplanes used to refine candidates. Often, producing such a hyperplane is a 
complicated task that depends heavily upon the definition of A. An algorithm that computes 
a separating hyperplane for a given candidate in this manner is called a separation oracle. 
The ellipsoid method guarantees that, given a polynomial-time separation oracle for A, the 
emptiness of A can be deduced in polynomial time. 

The details of the ellipsoid method are many and a proper discussion of those details 
would be tedious. In lieu of such a discussion, we cite an amusing analogy found in Reference 
\21\ page 73] that effectively conveys an intuition of how the ellipsoid method works: 

Recall the well-known method of catching a lion in the Sahara. It works as 
follows. Fence in the Sahara, and split it into two parts; check which part does 
not contain the lion, fence the other part in, and continue. After a finite number 
of steps we will have caught the lion (if there was any) because the fenced-in 
zone will be so small that the lion cannot move anymore. Or we realize that the 
fenced-in zone is so small that it cannot contain any lion. 

In this analogy, the Sahara is the vector space M" and the lion is the bounded, convex, and 
full-dimensional set A. The ellipsoid method specifies how to "fence in" some subset of M" 
and the separation oracle serves to split the fenced-in area and check which side contains the 
lion. 

Based on this analogy, the necessity of the requirement that A be bounded and full- 
dimensional becomes clear. If the lion were unbounded then it would be impossible to fence 
him in. On the other hand, if the lion were not full-dimensional then he would have zero 
length along one axis. We could conceivably continue fencing him in along that axis ad 
infinitum and he would still have room to move within the fenced-in area. 

Fortunately, the requirement that A be full-dimensional can often be dropped. For 
example, the case in which ^ is a full-dimensional subset of some "simple polyhedron" 
"P C M" can also be handled by the ellipsoid method as described in Reference fll\ Chapter 
6]. Moreover, any separation oracle for A may assume without loss of generality that the 
input vector x G M" is also an element of the polyhedron V. 
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4.3.4 The Set of Winning Yes-Provers Revisited 



As of now, the set Win(V, c) is defined only loosely as a set of winning transcripts for a 
double quantum interactive proof system. In this subsection, we provide a more precise 
definition of this set and show that it meets the criteria set out by the ellipsoid method. 

Before we proceed, we remind the reader of some of the notation used in Section 14.1.31 
In particular, 7i®" denotes the Hilbert space with dimension ndim(7i) and . . . , -B„) G 
L(7i®") denotes the block-diagonal matrix whose blocks are the matrices Bi, . . . ,Bn & L(7i). 

Let L C {0, 1}* be a language that has a double quantum interactive proof system with 
completeness error c and let V{x) = (Vb, . . . , Ki, Wi, . . . , Wr^) be a (ri + r2)-round verifier 
witnessing this fact. We define 

Win(l^, c) C H {{My ® V ® A^jv ® Af^^''^^) 

to be the set of all block-diagonal positive semidefinite matrices (Xq, ...,XrJ such that 
Xq = |0)(0| and the list Xi, . . . , is Aly-consistent with Vq, . . . , K-^-i and 

{D*D,Xr,) < c 

for all D of the form ()4.f)|l in Corollarv 14.131 

An advantage of defining Win(V, c) in this manner is that we can leverage the results of 
Section l^!T] to show that Win(y, c) is a proper candidate for use with the ellipsoid method. 
For example, the following lemma is a straightforward consequence of the work in that 
section. 

Lemma 4.14. Win(y, c) is bounded and convex. 

Proof. Let A G [0,1] and let X,Z E Win(V, c) with X = (|0) (0|, Xi, . . . , X^J and 
Z = (|0) (0|, Zi, . . . , Z^J. That AX + (1 — \)Z is block-diagonal with first block equal 
to |0)(0| follows immediately. Moreover, we know that X and Z satisfy the A^y- Consistency 
Constraints f Lemma 14. 4|) . Letting {A, a) be any one of these constraints, we have 

(A AX + (1 - X)Z) = A {A, X) + (1 - A) {A, Z) = Xa + {1 - X)a = a, 

from which it follows that AX + {1 + X)Z also satisfies the A^y-Consistency Constraints 
(Lemma 14. 4j) . By similar reasoning, any matrix D for which {D*D, Xr^) < c and 
{D*D, Zr-^) < c also satisfies 

{D*D,XXr, + (1 - X)Zr,) < c, 

completing the proof that Win(V, c) is convex. 

That Win(V^, c) is bounded follows from the Aly- Consistency Constraint Bound (Lemma 
14. 5|) . which tells us that any element of Win(V, c) has spectral norm at most 1. □ 

According to the discussion in Section B:.3.3l if we are to use the ellipsoid method to decide 
the emptiness of Win(V", c) then it is necessary that the set be polynomial-time isomorphic 
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to a full-dimensional subset of some "simple polyhedron" in R". We now argue that such an 
isomorphism exists. 

For our purposes, a simple polyhedron in M" is any set V defined explicitly as an intersec- 
tion of at most p{n) halfspaces for some fixed p G poly. For example, the A^y- Consistency 
Constraints define a simple polyhedron C in the vector space of n x n Hermitian matrices, 
which is readily identified with M" as mentioned in Section I3.2.11 Hence, it is suffices to 
prove the following lemma. 

Lemma 4.15. For every d > c, Win(V, c') is a full-dimensional subset of C if it is nonempty. 
Proof. By definition, every element X G Win(V, c'): 

• is block-diagonal with first block equal to |0)(0|; 

• satisfies the A^y-Consistency Constraints; 

• is positive semidefinite; and 

• satisfies {D*D,X) < c < c' for all appropriately chosen D. 

The first two restrictions are precisely the definition of the simple polyhedron C, from 
which it follows that Win(V, c') C C. As the positive semidefinite matrices are a full- 
dimensional subset of the Hermitian matrices, it follows that the third restriction does not 
decrease the dimension of Win(V, c'). 

For the final restriction, a simple continuity argument shows that if X satisfies 
{D*D,X) < c' for some D then so must all X' in some neighbourhood of X. Hence, 
this final restriction also does not decrease the dimension of Win(V, c'). □ 

Lemma f4. 151 tells us that if the verifier V{x) has completeness error strictly smaller than 
c then Win(V, c) is a full-dimensional subset of the simple polyhedron C. As Win(V, c) is 
also bounded and convex, it follows that the ellipsoid method can decide its emptiness if 
provided with an efficient separation oracle. 

4.3.5 A Separation Oracle 

We have seen that the set Win(y, c) qualifies for use with the ellipsoid method provided that 
the verifier V has completeness error strictly smaller than c, but it remains to show that there 
exists an efficient separation oracle for that set. Recall from Section [4.3.31 that a separation 
oracle for Win(V^, c) is a computational problem that takes as input a candidate Hermitian 
matrix X and outputs either (i) an assertion that X G Win(y, c); or (ii) a hyperplane 
separating X from Win(V, c). In this subsection we formalize the statement of that problem 
and we provide a polynomial-time solution. 

The separation oracle we seek for Win(V, c) solves the problem SEP(V, c) defined in Figure 
14.81 f compare with Reference pTl Theorem 3.2.1]). As with SDP and opt, we assume that 
the real and imaginary parts of all input numbers (including c and the matrices belonging 
to V) are represented in binary notation. 
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Problem. SEP{V,c). 

Input. A block- diagonal Hermitian matrix X E H((A^y 0V Mn ® A/')®''^"*"^) satisfying 
the TVly- Consistency Constraints (Lemma 14 .41) with first block equal to |0)(0| and an 
accuracy parameter e > 0. 

Output. One of the following: 

1. A block-diagonal Hermitian matrix H E H((A<y V Mn ® A/')®'"^+^) with 
\\H\\ = 1 such that {H, Z) < {H, X) + e for every Z E Win{V, c). 

2. An assertion that if Win(V", c) is nonempty then there exists X' E Win(V, c) with 
IIX -X'll < e. 



Figure 4.8: Definition of SEP(V, c) 

As per the discussion in Sections l4.H.HI and l4.H.4[ we assume without loss of generality that 
the input matrix X to our separation oracle already satisfies the A^y- Consistency Constraints 
(Lemma l4.4|) . as these constraints define a simple polyhedron C of which Win(V, c) is a full- 
dimensional subset. 

It is instructive to note that SEP(V, c) implements a weak separation oracle in the following 
sense. Output case 1 in Figure 14.81 allows us to reject a "good" yes-prover if it is close to 
a "bad" yes prover. Conversely, output case 2 implies that we may accept a "bad" yes- 
prover so long as it is close to a "good" yes prover. We will soon see that leeway afforded 
to us by the bounded-error requirement for quantum refereed games permits this convenient 
relaxation. This bounded-error requirement will also permit us the necessary assumption 
that the verifier's completeness error be strictly less than c. 

The remainder of this subsection is devoted to proving the following theorem. 

Theorem 4.16. SEP(V", c) can be solved in time polynomial in the bit lengths of {V, c) and 
the input data. 

Proof. Figure describes a polynomial-time algorithm for SEP(V,c). We now verify the 
correctness of that algorithm. 

If step 2 is reached then X = (|0)(0|,Xi, . . . ,XrJ must be positive semidefinite where 
the hst Xi, . . . , Xr-^ is A^y-consistent with Vq, . . . , Ki-i- Existence of the unitary matrices 
Yi, . . . , then follows from the Consistency Characterization f Lemma 14. 2|) . The matrices 
Xi, . . . , Xr^ represent a transcript for the yes-prover defined hy Y{x) = (Yi, . . . , YrJ. 

Suppose first that the halting condition is reached in step 3. We prove that every no- 
prover loses to Y{x). Let N{x) = Ni, . . . , iV^j be any no-prover and let p (respectively p) 
denote the probability with which N{x) convinces V{x) to reject x given Y{x) (respectively 
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1. If X is not positive semidefinite then let w be a unit vector satisfying u*Xu < 0. Halt 
and output case 1, returning —uu*. 

2. Write X = (|0)(0|, Xi, . . . , X^J and let Yi, . . . , Y^, G \J{y My) be unitary matrices 
satisfying 

\\DYr,Vr,-i ■ ■ ■ V,Y,Vo\0) f = {D*D, X^,) 

for all matrices D not acting on y. Let C — ynKi-i • • • ^i^iVb and compute an 
approximation (7 of C satisfying ||C — < |. 

3. Solve OPT with input matrices KiC", W^i, • • • , Wr^-i-i nrejectW^r2 accuracy parameter 
|. Let VD denote the optimal value indicated by this solution. If < c then halt and 
output case 2. 

4. Otherwise, OPT returned matrices ^i, . . . , e Pos(0^ ® My ® V ® Mn) Mn- 
consistent with Vr-^C ,Wi, . . . , Wr^-i such that 

(W^^n^ejectHreJectW^.,, Z,,) = W > C. 

Let A^i, . . . , e U(A^iv ® -N") be unitary matrices satisfying 

Let D = ni.cjcctW^r2^r2W^r2-i ' ' ' W^i^iKj and compute an approximation D of D sat- 
isfying ||D — D|| < |. Halt and output case 1, returning the block- diagonal matrix 

(0,...,0,D*D)- 



Figure 4.9: A polynomial-time algorithm for SEP(y, c) 



61 



Y{x)) so that 

p = II U,,^,,,Wr,Nr,Wr,., ■ ■ ■ W,N,Vr,C\0) f, 
p = II U,,^ectWr,Nr,Wr,-l ■ ■ ■ W,N,Vr,C\0) f . 

By our choice of accuracy parameter for opt we have 

and by Lemma [4.71 with ||C — C|| < | we have 

\P-P\ < 2- = -, 

from which it follows that p < c + e. As N{x) was chosen arbitrarily, it follows that the 
transcript X is at least "close" to Win(V, c) as required by output case 2 in the definition 
of SEP(V, c). 

Next, suppose that the algorithm proceeds to step 4. We prove that the returned matrix 
(0, . . . , 0, D*D) indicates an "almost" separating hyperplane as required by output case 1 in 
the definition of SEP(V, c). 

We start by showing that {D*D, X^j^) is large. Existence of the unitary matrices 
A^i, . . . , in step 4 follows from the Consistency Characterization fLemma l4.2j) . By Lemma 
Em with ||C - (711 < I and ||D - Z)|| < | we have 

c< \\DC\0)f< \\DC\0)f + ^e={D*D,Xr,) + ^e. (4.7) 

Choose any transcript X' G Win(V, c) and write X' = (|0)(0|, X(, . . . , X^J. We now 
show that {D*D,X'^_^) is small. Let Y'{x) = (Y(, . . . ,Y^J he a yes-prover giving rise to the 
transcript X' and let C = K/^Ki-i ■ ■ ■ ViYIVq. We have 

c>{D*D,X'J = \\DC'\0)f > \\DC'\0)f-^ = {D*D,X'J - | (4.8) 

Combining ()4.7|) and ()4.8|) we obtain 

< {D*D,Xr,)+e 

as required by output case 1 in the definition of SEP(V, c). The algorithm is therefore correct. 

It remains only to verify that this algorithm runs in polynomial time. Using any estab- 
lished method for computing a unitary matrix witnessing the Unitary Equivalence of Purifi- 
cations (Fact l^Tjl . we can approximate the matrices Yi, . . . , Fj-i in step 2 and Ni, . . . , in 
step 4 to t bits of precision in time polynomial in t and the dimensions of those matrices. 
The desired approximations C and D can then be computed in poljTiomial time by choosing 
an appropriate t according to Section [4.2.11 As the input matrices to OPT in step 3 can be 
computed in polynomial time and have at most polynomial dimension, the desired result 
follows from the fact that OPT admits a polynomial-time solution (Theorem I4.fij) . □ 
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1. Run the exponential-time Turing machine that generates the verifier's quantum circuits 
on input string x G {0, 1}*. Let V{x) = (Vq, . . . , K-^, Wi, . . . , Wr2) denote the unitary 
matrices associated with these circuits. 

2. Compute an approximation V{x) = (Vq, . . . ,Vrj^, Wi, . . . , Wr^) of V{x) satisfying 

llV^i - Vi\\, \\Wi - Wj\\ < — 

" ' 8(ri+r2 + l) 

for every i G {0, . . . , ri} and every j G {1, . . . , r2}. 

3. Let c' = c + I and use the elhpsoid method with an oracle for SEP(\^, c') with accuracy 
parameter | to decide the emptiness of Win(V^, c'). If it is empty then reject x, 
otherwise accept x. 



Figure 4.10: An exponential-time algorithm for L G DQIP 
4.3.6 At Long Last 

Now that SEP(y, c) has been shown to admit a polynomial-time solution (Theorem I4.1(j|l . 
we are finally ready to prove the upper bound SQG C EXP. Indeed, we prove that the 
containment holds under the following relaxations of the definition of SQG: 

• The verifier may exchange an exponential number of messages with the yes-prover 
followed by an exponential number of messages with the no-prover. 

• The verifier's quantum circuits may contain an exponential number of gates, so long 
as they still act upon at most a polynomial number of qubits. 

• The completeness error and soundness error may be exponentially close to | in 

Recall the definitions of a strong verifier f Section I4.2.2j) and a double quantum interactive 
proof system (Section 14. 3. 2j) . We prove the following theorem. 

Theorem 4.17 (An extension of SQG C EXP). Let c, s : N — * [0, 1] be any polynomial- 
time computable functions satisfying 1 — c{n) — s{n) > for all n G N. Any language 
L C {0, 1}* that can be decided by a double quantum interactive proof system with a strong 
verifier having completeness error c and soundness error s is in EXP. 

Proof. Let e = 1—c—s. It follows from the fact that c and s are polynomial-time computable 
that e G 2-f"'^y. 

Figure E.IUI describes a deterministic exponential-time algorithm that decides L. To see 
that this algorithm is correct, let c and s denote the completeness error and soundness error 
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respectively of V{x). It follows from Lemma 14.71 with the approximations of step 2 that 
c < c + I and s < s + |. As 

3 

l-c-s>l-c-s £:>0 

4 

it follows from Corollary 14.121 that Win(y,c') is nonempty if and only if x E L. As V{x) 
has completeness error strictly smaller than c', it follows from the remarks in Section [4.3.41 
that the set Win(\/, c') qualifies for use with the ellipsoid method. 

It remains only to verify our choice of accuracy parameter to SEP(V^, c'). Suppose that 
the ellipsoid method found that Win(V, c') is nonempty. Then there must exist a transcript 
X for which the maximum probability with which V{x) rejects x is smaller than 

, e 3 e ^ ^ 

c + - = c+-e = l — s — -< 1 — s. 

4: 4: 4 

As this transcript violates the soundness condition, it must be the case that x E L. 

Conversely, suppose the ellipsoid method found that Win(l^, c') is empty. Then for every 
transcript X the maximum probability with which V{x) rejects x is larger than 

c'-- = c+->c. 
4 4 

As every transcript violates the completeness condition, it must be the case that x ^ L. 

That our algorithm runs in exponential time follows from the fact that SEP(V^, c') admits a 
polynomial-time solution ( Theorem 14. 16|) and from the polynomiality of the ellipsoid method. 

□ 
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Chapter 5 
Conclusion 



The work of this thesis initiates the study of quantum refereed games. We chose to focus on 
short quantum games, proving the containments QIP C SQG* in Chapter |21 and SQG C EXP 
in Chapter m 

Figure l^?T] summarizes some known relationships among the complexity classes considered 
in this thesis. In that figure, DQIP denotes the class of languages with double quantum 
interactive proof systems as defined in Section [4.3.21 and coDQIP its complement. As with 
Figure 11.11 a class A contains class B if A can be reached from B by following a path of only 
upwardly sloped edges. 

5.1 Open Problems 

We now discuss several open questions relating to the material covered in this thesis. 
5.1.1 Parallelization 

It is known that any fc-message classical interactive proof system can be simulated by a 
two- message interactive proof system for any constant G N |5i| jT2] . The complexity class 
corresponding to two-message interactive proof systems is known as AM and is contained in 
□2, the second level of the polynomial-time hierarchy. 

As IP = PSPACE, it is widely believed that interactive proof systems with a polynomial 
number of messages are strictly more powerful than fc-message interactive proof systems. In 
contrast, we mentioned in Section [2.2.11 that any quantum interactive proof system can be 
simulated by a three- message quantum interactive proof system |31j. 

One can also ask whether a similar parallelization result holds for refereed games. In 
the classical case, we mentioned in Sect ion Fl . 2 . 51 1 hat one- round refereed games characterize 
PSPACE and that many-round refereed games characterize EXP ^^l- However, little is 
known about the power of refereed games intermediate between these two extremes. For 
example, games with a constant number of rounds may correspond to PSPACE, EXP, or 
some complexity class between the two. 
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NEXP 



coNEXP 



QRG = coQRG 




IP = PSPACE = RG 



Figure 5.1: Relationships among complexity classes discussed in this thesis 

Even less is known in the quantum case. For example, it is unclear how to solve close- 
images with a short quantum game if the verifier is not permitted to process the yes-prover's 
message before sending a message to the no-prover fSection l3.3|) . Does this ability separate 
one-round quantum refereed games from short quantum games? 

5.1.2 Parallel Repetition 

Suppose we wish to reduce the error of a given interactive protocol without increasing the 
number of messages in that protocol. In Section l3.4.1l we described an approach to this prob- 
lem called parallel repetition. Essentially, the idea is to run many copies of the interaction in 
parallel and accept or reject based upon a vote of the outcomes of the individual repetitions. 
The hope is that Chernoff bounds can be used to prove that the error of the repeated game 
decreases exponentially in the number of repetitions. Of course, we must take into account 
the fact that the provers need not cooperate with the verifier by treating each repetition 
independently, and therein lies the rub. 

Although parallel repetition has been successfully applied to single- and multi-prover 
classical interactive proof systems (see, for instance, Raz |SZ|), this problem has not been 
completely solved in the quantum setting. It is known that parallel repetition followed by 
a unanimous vote of the outcomes works to reduce the soundness error for three-message 
quantum interactive proof systems with zero completeness error [21]. We extended that 
result in this thesis to obtain a partial robustness result for short quantum games (Theorem 
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EH). 

However, several questions remain unanswered. Does parallel repetition work in the 
quantum setting if it is followed by a majority vote of the outcomes instead of a unanimous 
vote? Is it even possible to improve the error of fc-round quantum refereed games for k > 2 
without increasing the number of rounds? 

5.1.3 Insight into QIP and SQG 

The cumulative results of this thesis can be viewed as wedging several complexity classes 
between QIP and EXP — in particular, 

QIP C SQG, C SQG C DQIP C EXP. 

In a sense, it seems as though QIP is buried deeply inside EXP. Can we prove QIP = PSPACE? 

It is clear that DQIP contains both QIP and coQIP. Does SQG also contain coQIP? Are 
either of QIP or SQG closed under complement? 

5.1.4 Do Quantum Refereed Games Characterize EXP? 

In this thesis we proved that QRG C NEXP (Theorem I4.11|) . It follows immediately from the 
fact that QRG is closed under complement that QRG C coNEXP. Combined with the fact 
that EXP C QRG, we have 

EXP C QRG C NEXP n coNEXP. 

In the realm of polynomial-time computation, problems known to be in NP fl coNP yet 
not known to be in P are rare and often the subject of intense study. In many cases, a 
problem with this property is later discovered to lay in P and the accompanying proof of this 
fact can sometimes offer new insights in complexity theory. Popular examples of this trend 
include the linear programming problem and the primality testing problem pD|. Based 
upon this historical precedent and upon recent unpublished work by the author, we make 
the following conjecture: 

Conjecture 5.1. QRG = EXP. 

Aside from offering a rare quantum characterization of a classical complexity class, such a 
collapse would also imply that classical refereed games are polynomially equivalent in power 
to quantum refereed games. If true, this equivalence would be a powerful negative example 
of a case in which the use of quantum information offers no advantage over the use of classical 
information. 
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